Vulnerability · Published Aug 1, 2022 · Assigned by GitHub_M

CVE-2022-31155Unauthorized overwriting of saved searches in Sourcegraph

Medium 4.3

In plain English

A medium-severity incorrect authorization in sourcegraph from sourcegraph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only overwriting them with attacker-controlled searches. The issue is patched in Sourcegraph version 3.41.0. There is no workaround for this issue and updating to a secure version is highly recommended.

Affected products (as reported)

Vendor	Product	Versions
sourcegraph	sourcegraph	< 3.41.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-37qp-9jq6-f6mx x_refsource_CONFIRM
https://github.com/sourcegraph/sourcegraph/commit/2832d7882396a6295ba5803b5ef48dc7d5a24c59 x_refsource_MISC