CVE-2022-41942

 

Published at: - 22-11-2022 08:15

Last modified: - 22-11-2022 08:17

Total changes: - 1

Description

Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-pfm3-23mh-6xjp
• https://github.com/sourcegraph/sourcegraph/pull/42553

 

Keywords

NVD

 

CVE-2022-41942

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures