PT-2022-20569 · Sourcegraph · Sourcegraph

Published 2022-08-01 · Updated 2022-08-08 · CVE-2022-31154

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sourcegraph versions prior to 3.42

Description The issue allows an authenticated Sourcegraph user to edit Code Monitors owned by any other Sourcegraph user, including editing the trigger and action of the monitor. However, an attacker cannot read the contents of existing code monitors, only override the data.

Recommendations For versions prior to 3.42, update to Sourcegraph 3.42 to resolve the issue, as patching is highly recommended and there are no available workarounds.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-31154

GHSA-5866-HHQ9-9HPC

Affected Products

Sourcegraph

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31154.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-31154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31154 · Security Note
• ❌ https://github.com/sourcegraph/sourcegraph/pull/37526 · Patch, Deleted
• ❌ https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-5866-hhq9-9hpc · Note, Deleted
• https://t.me/cibsecurity/47369 · Telegram Post