CVE-2022-41942 — Sourcegraph vulnerable to Comand Injection via gitserver
Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployment…
Published: 2022-11-22 · CVSS: 7.9 · CVSS 3.1
Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7