CVE-2022-41943 CRITICAL

CVE-2022-41943: Incorrect default permissions found in Sourcegraph

Vendor Sourcegraph
Product sourcegraph
Weakness CWE-276
Published November 22, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

9.0/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

Key dates

02Disclosure timeline

November 22, 2022 CVE published
April 23, 2025 Record updated