CVE-2022-24727

highrejectedPriorität · verfolgen · 0US
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
— EPSS
CVSS 7.2 · high
Is it mine?
2 products
Prüfe deine Angriffsfläche
Who says so?
3 sources
cnnvd · enisa_euvd · osv

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-23915. Reason: This candidate is a reservation duplicate of CVE-2022-23915. Notes: All CVE users should reference CVE-2022-23915 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

01

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.2
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV
02

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-77USCWE-88US
03

betroffene Produkte (2)

Betroffene Produkte und Versionsbereiche.

04

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

  • GHSA-3872-f48p-pxqjImproper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate2022-03-04ghsa · osvUS

    ### Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way. ### Patches The issues were fixed in the 4.11.1 release. The following commits are addressing it: * 35d59f1f040541c358cece0a8d4a63183ca919b8 * d83672a3e7415da1490334e2c9431e5da1966842 ### Workarounds Instances in which untrusted users cannot create new components are not affected. ### References * [SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088) ### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)

  • GHSA-h2g5-2rhx-ffgjDuplicate Advisory: Command injection in Weblate2022-03-05ghsa · osvUS

    ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3872-f48p-pxqj. This link is maintained to preserve external references. ## Original Description Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.

  • BIT-weblate-2022-239152024-03-06vendor · osvUS

    The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

  • CVE-2022-23915Remote Code Execution (RCE)2022-03-04vendor · osvUS

    The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

  • PYSEC-2022-1622022-03-04vendor · osvUS

    Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.

  • PYSEC-2022-312022-03-04vendor · osvUS

    The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

05

auch bekannt als (9)

Weitere Namen und Kennungen dieser Entität.

06

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdosvNVDCVE.orgMITRE
veröffentlicht 2022-03-04geändert 2023-11-07
07

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

Keine Referenzen erfasst.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan