CVE-2022-41942CWE-20CWE-78

Sourcegraph vulnerable to Comand Injection via gitserver

High · published November 22, 2022

CVSS v3.1
7.9
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.

The record
Technical detail
CVSS v3.1
7.9 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.02808 · 86.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-11-22T00:00Z
EPSS history
Timeline
  • 22 NOV 00:00Z
    Sourcegraph vulnerable to Comand Injection via gitserver
    cvelistv5