PT-2022-16834 · Weblate · Weblate

Published 2022-03-04 · Updated 2024-03-06 · CVE-2022-24727

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 4.11.1

Description Weblate is a web-based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issue allows authenticated users to change the behavior of the application in an unintended way, leading to command execution via argument injection when using Git or Mercurial repositories.

Recommendations For Weblate versions prior to 4.11.1, update to version 4.11.1 or later to resolve the issue. As a temporary workaround, consider restricting access to Git and Mercurial repositories for untrusted users. Additionally, instances where untrusted users cannot create new components can be considered not affected, thus no immediate action is required for these cases.

Fix

Argument Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-77

Related Identifiers

BIT-WEBLATE-2022-23915

CVE-2022-24727

GHSA-3872-F48P-PXQJ

GHSA-H2G5-2RHX-FFGJ

PYSEC-2022-162

PYSEC-2022-31

Affected Products

Weblate

References · 21

• https://osv.dev/vulnerability/GHSA-h2g5-2rhx-ffgj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24727 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23915 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-31 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-162 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3872-f48p-pxqj · Vendor Advisory
• https://osv.dev/vulnerability/BIT-weblate-2022-23915 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/pull/7338 · Note
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1 · Note
• https://github.com/WeblateOrg/weblate/pull/7337 · Note
• https://github.com/WeblateOrg/weblate/commit/35d59f1f040541c358cece0a8d4a63183ca919b8 · Note
• https://github.com/WeblateOrg/weblate/commit/d83672a3e7415da1490334e2c9431e5da1966842 · Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3872-f48p-pxqj · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2022-31.yaml · Note