CVE-2022-41943

High

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the…

GitHub_M·CWE-276·Published 2022-11-22

CVSS

7.2

EPSS

0.02

KEV

Exploits

cve.orgen

285 chars

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

NVDen

285 chars

NVDes

331 chars

sourcegraph es una plataforma de inteligencia de código. Como administrador del sitio, era posible ejecutar comandos arbitrarios en Gitserver cuando la función experimental "customGitFetch" estaba habilitada. Esta función experimental ahora se ha desactivado de forma predeterminada. Este problema se solucionó en la versión 4.1.0.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.0	—	—	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
3.1	Primary	cve.org	9.0	—	—	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
3.1	Primary	NVD	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
3.1	Secondary	NVD	9.0	2.3	6.0	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L