Vulnerability · Published Nov 22, 2022 · Assigned by GitHub_M
CVE-2022-41942Sourcegraph vulnerable to Comand Injection via gitserver
High 7.9
In plain English
A high-severity improper input validation in sourcegraph from sourcegraph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities).
Official description
Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sourcegraph | sourcegraph | < 4.1.0 |
Weakness: CWE-20, CWE-78 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L