CVE-2022-31155: falha de média gravidade em sourcegraph
Unauthorized overwriting of saved searches in Sourcegraph
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.5%
Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only overwriting them with attacker-controlled searches. The issue is patched in Sourcegraph version 3.41.0. There is no workaround for this issue and updating to a secure version is highly recommended.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
sourcegraph · sourcegraphCVEs relacionadas — sourcegraph
No mesmo produto, das mais perigosas para as menos.
CVE-2022-23642HIGHCode Injection in SourcegraphEPSS 74.3%CVE-2022-41942HIGHSourcegraph vulnerable to Comand Injection via gitserverEPSS 2.8%CVE-2022-41943CRITICALIncorrect default permissions found in SourcegraphEPSS 1.8%CVE-2022-29171MEDIUMRemote Code Execution in sourcegraphEPSS 1.4%CVE-2021-43823MEDIUMSide-channel attack in SourcegraphEPSS 0.9%CVE-2022-23643MEDIUMSide-channel attack in Sourcegraph Code MonitorsEPSS 0.8%