CVE-2022-31154

    Dashboard / Vulnerabilities / CVE-2022-31154

    CVE-2022-31154

    Published: 1 Aug 2022Last Modified: 8 Aug 2022

    Summary:

    Details: Sourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned by any other Sourcegraph user. This includes being able to edit both the trigger and the action of the monitor in question. An attacker is not able to read contents of existing code monitors, only override the data. The issue is fixed in Sourcegraph 3.42. There are no workaround for the issue and patching is highly recommended.

    References: https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-5866-hhq9-9hpc, https://github.com/sourcegraph/sourcegraph/pull/37526

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -8cf5aa13c21715e357423932aaff8f2803840a30

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31154 | CVE-DB