TI-2021-12453 Aliases CVE-2021-32787

Low risk information disclosure in Sourcegraph

LOW 21CWE-200Published 2021-08-02 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed by regular users and all information and features are properly protected except for daily usage statistics and code intelligence uploads and indexes. It is not possible to alter the information, nor interact with any other features in the site-admin area. The issue is patched in version 3.30.0, where the information cannot be accessed by unprivileged users. There are no workarounds aside from upgrading.

Why it matters now

EPSS 0.00649 51st percentileScored 2026-11-07

Fix Fixed sourcegraph (sourcegraph): 3.30.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sourcegraph	sourcegraph	before 3.30.0	3.30.0	Patch available	CNA

sourcegraph Vendorsourcegraph Affected before 3.30.0 Fixed in 3.30.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sourcegraph:sourcegraph::::::::	before 3.30.0	Vulnerable	sourcegraph

cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:* Versions before 3.30.0 Vulnerable ·sourcegraph

Remediation

Fix · CNA sourcegraph (sourcegraph) Fixed in 3.30.0

Timeline

2026-10-02 Threatist record created from CVE-2021-32787
2026-10-16 EPSS moved to the 50th–90th percentile

References

Patch 1

https://github.com/sourcegraph/sourcegraph/commit/6e51f4546368d959a1f9f173d16e5f20c55deb56

Advisory 1

https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-mq5p-477h-xgwv

TI-2022-07694 Code Injection in Sourcegraph CVSS 3.1HIGH 8.8
TI-2022-20284 Incorrect default permissions found in Sourcegraph CVSS 3.1CRITICAL 9.0
TI-2022-20283 Sourcegraph vulnerable to Comand Injection via gitserver CVSS 3.1HIGH 7.9
TI-2022-11715 Remote Code Execution in sourcegraph CVSS 3.1HIGH 7.2
TI-2022-07695 Side-channel attack in Sourcegraph Code Monitors CVSS 3.1MEDIUM 6.5
TI-2021-19629 Side-channel attack in Sourcegraph CVSS 3.1MEDIUM 6.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences