PT-2022-16332 · Weblate · Weblate

Alessio Della Libera · Published 2022-03-04 · Updated 2024-03-06 · CVE-2022-23915

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Weblate versions 0 through 4.11.1

Description:

The issue allows Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users can change the behavior of the application in an unintended way, leading to command execution. Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected.

Recommendations:

For Weblate versions 0 through 4.11.1, update to version 4.11.1 or later to resolve the issue. As a temporary workaround, consider restricting access to instances where untrusted users can create new components to minimize the risk of exploitation.

Fix

Command Injection

Argument Injection

Weakness Enumeration

CWE-77

CWE-88

Related Identifiers

BIT-WEBLATE-2022-23915

CVE-2022-23915

GHSA-3872-F48P-PXQJ

GHSA-H2G5-2RHX-FFGJ

PYSEC-2022-162

PYSEC-2022-31

SNYK-PYTHON-WEBLATE-2414088

Affected Products

Weblate

References · 22

• https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1 · Patch
• https://github.com/WeblateOrg/weblate/pull/7337 · Patch
• https://github.com/WeblateOrg/weblate/pull/7338 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-162 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23915 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-weblate-2022-23915 · Vendor Advisory
• https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24727 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23915 · Security Note
• https://osv.dev/vulnerability/GHSA-h2g5-2rhx-ffgj · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-31 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3872-f48p-pxqj · Vendor Advisory
• https://github.com/WeblateOrg/weblate/commit/d83672a3e7415da1490334e2c9431e5da1966842 · Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3872-f48p-pxqj · Note
• https://github.com/WeblateOrg/weblate/commit/35d59f1f040541c358cece0a8d4a63183ca919b8 · Note