CVE-2022-23642highCWE-94

CVE-2022-23642: fallo de gravedad alta en sourcegraph

Code Injection in Sourcegraph

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear sourcegraph

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

78Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.8epss 74%
de la publicación al arma112 días
Publicada en NVD18 feb
1ª PoC+112d
metasploit18 feb
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
sourcegraph · sourcegraph
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — sourcegraph

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-41942HIGHSourcegraph vulnerable to Comand Injection via gitserverEPSS 2.8%CVE-2022-41943CRITICALIncorrect default permissions found in SourcegraphEPSS 1.8%CVE-2022-29171MEDIUMRemote Code Execution in sourcegraphEPSS 1.4%CVE-2021-43823MEDIUMSide-channel attack in SourcegraphEPSS 0.9%CVE-2022-23643MEDIUMSide-channel attack in Sourcegraph Code MonitorsEPSS 0.8%CVE-2021-32787LOWLow risk information disclosure in SourcegraphEPSS 0.6%