Описание
sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental customGitFetch feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.
Ссылки
- Issue TrackingPatchThird Party Advisory
- Third Party Advisory
- Issue TrackingPatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.1.0 (исключая)
cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:*
EPSS
Процентиль: 49%
0.00255
Низкий
9 Critical
CVSS3
7.2 High
CVSS3
Дефекты
CWE-276
EPSS
Процентиль: 49%
0.00255
Низкий
9 Critical
CVSS3
7.2 High
CVSS3
Дефекты
CWE-276