TI-2022-20284 Aliases CVE-2022-41943

Incorrect default permissions found in Sourcegraph

MEDIUM 45CWE-276Published 2022-11-22 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01848 79th percentileScored 2026-11-07

Fix Fixed sourcegraph (sourcegraph): 4.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sourcegraph	sourcegraph	before 4.1.0	4.1.0	Patch available	CNA

sourcegraph Vendorsourcegraph Affected before 4.1.0 Fixed in 4.1.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sourcegraph:sourcegraph::::::::	before 4.1.0	Vulnerable	sourcegraph

cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·sourcegraph

Remediation

Fix · CNA sourcegraph (sourcegraph) Fixed in 4.1.0

Timeline

2026-10-02 Threatist record created from CVE-2022-41943

References

Patch 1

https://github.com/sourcegraph/sourcegraph/pull/42704

Advisory 1

https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-4qhq-4x4h-fxm8

TI-2022-07694 Code Injection in Sourcegraph CVSS 3.1HIGH 8.8
TI-2022-20283 Sourcegraph vulnerable to Comand Injection via gitserver CVSS 3.1HIGH 7.9
TI-2022-11715 Remote Code Execution in sourcegraph CVSS 3.1HIGH 7.2
TI-2022-07695 Side-channel attack in Sourcegraph Code Monitors CVSS 3.1MEDIUM 6.5
TI-2021-19629 Side-channel attack in Sourcegraph CVSS 3.1MEDIUM 6.5
TI-2020-09815 Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper… CVSS 3.1MEDIUM 6.1

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences