Vulnerability · Published Aug 1, 2022 · Assigned by GitHub_M

CVE-2022-31154Indirect Object Access in Sourcegraph Code Monitoring

Medium 6.4

In plain English

A medium-severity incorrect authorization in sourcegraph from sourcegraph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned by any other Sourcegraph user. This includes being able to edit both the trigger and the action of the monitor in question. An attacker is not able to read contents of existing code monitors, only override the data. The issue is fixed in Sourcegraph 3.42. There are no workaround for the issue and patching is highly recommended.

Affected products (as reported)

Vendor	Product	Versions
sourcegraph	sourcegraph	< 3.42

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

References

https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-5866-hhq9-9hpc x_refsource_CONFIRM
https://github.com/sourcegraph/sourcegraph/pull/37526 x_refsource_MISC