CVE-2022-41942

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-419437.2sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimenta CVE-2022-419444.3Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13 CVE-2022-419459.8super-xray is a vulnerability scanner (xray) GUI launcher. In version 0.1-beta, the URL is not filtered and directly spliced into the comm CVE-2022-419465.5pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, Inpu CVE-2022-419475.4DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features CVE-2022-419487.2DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are sub CVE-2022-419494.3DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an a CVE-2022-41954.3Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing w CVE-2022-419507.8super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. Th CVE-2022-419519.8OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Pat CVE-2022-419525.3Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly li CVE-2022-419537.8Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on