CVE-2021-32787 Low risk information disclosure in Sourcegraph
Regular users can access site-admin statistics and index data, leading to information disclosure in Sourcegraph.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32787?
CVE-2021-32787 is a low-severity vulnerability in sourcegraph, published on 2 Aug 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed by regular users and all information and features are properly protected except for daily usage statistics and code intelligence uploads and indexes. It is not possible to alter the information, nor interact with any other features in the site-admin area. The issue is patched in version 3.30.0, where the information cannot be accessed by unprivileged users. There are no workarounds aside from upgrading.
Weakness: CWE-200
Which versions are affected by CVE-2021-32787?
It affects 1 product.
Products include Sourcegraph Sourcegraph.
How do I fix CVE-2021-32787?
No fix has been published for CVE-2021-32787 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32787 being exploited?
There is no known exploitation of CVE-2021-32787 in the wild and no public exploit code.