CVE-2022-31155 MEDIUM

CVE-2022-31155: Unauthorized overwriting of saved searches in Sourcegraph

Vendor Sourcegraph
Product sourcegraph
Weakness CWE-863 · Incorrect authorization
Published August 1, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only overwriting them with attacker-controlled searches. The issue is patched in Sourcegraph version 3.41.0. There is no workaround for this issue and updating to a secure version is highly recommended.

Key dates

02Disclosure timeline

August 1, 2022 CVE published
April 23, 2025 Record updated