CVE-2022-23915 HIGH

CVE-2022-23915: Remote Code Execution (RCE)

Vendor N/A
Product Weblate
Published March 4, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Key dates

02Disclosure timeline

March 4, 2022 CVE published
September 17, 2024 Record updated