CVE-2022-31155 Unauthorized overwriting of saved searches in Sourcegraph

What is CVE-2022-31155?

CVE-2022-31155 is a medium-severity missing authorization vulnerability in sourcegraph, published on 1 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only overwriting them with attacker-controlled searches. The issue is patched in Sourcegraph version 3.41.0. There is no workaround for this issue and updating to a secure version is highly recommended.

Weakness: CWE-863

Which versions are affected by CVE-2022-31155?

It affects 1 product.

Products include Sourcegraph Sourcegraph.

How do I fix CVE-2022-31155?

No fix has been published for CVE-2022-31155 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-31155 being exploited?

There is no known exploitation of CVE-2022-31155 in the wild and no public exploit code.

Other vulnerabilities in sourcegraph

• CVE-2022-41943 Incorrect default permissions found in Sourcegraph Critical 9.0
• CVE-2022-23642 Code Injection in Sourcegraph High 8.8
• CVE-2022-41942 Sourcegraph vulnerable to Comand Injection via gitserver High 7.9
• CVE-2022-29171 Remote Code Execution in sourcegraph Medium 6.6
• CVE-2022-23643 Side-channel attack in Sourcegraph Code Monitors Medium 6.5

Sources

• CVE record
• NVD
• OSV
• How this page is made