CVE-2022-24727

highrejectedpriority · track · 0US
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
— EPSS
CVSS 7.2 · high
Is it mine?
2 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · osv

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-23915. Reason: This candidate is a reservation duplicate of CVE-2022-23915. Notes: All CVE users should reference CVE-2022-23915 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

01

cvss

Technical severity, 0–10. One row per scoring source.

7.2
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-77USCWE-88US
03

affected products (2)

Products and version ranges known to be affected.

04

advisories (6)

Vendor and ecosystem advisories describing this.

  • GHSA-3872-f48p-pxqjImproper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate2022-03-04ghsa · osvUS

    ### Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way. ### Patches The issues were fixed in the 4.11.1 release. The following commits are addressing it: * 35d59f1f040541c358cece0a8d4a63183ca919b8 * d83672a3e7415da1490334e2c9431e5da1966842 ### Workarounds Instances in which untrusted users cannot create new components are not affected. ### References * [SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088) ### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)

  • GHSA-h2g5-2rhx-ffgjDuplicate Advisory: Command injection in Weblate2022-03-05ghsa · osvUS

    ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3872-f48p-pxqj. This link is maintained to preserve external references. ## Original Description Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.

  • BIT-weblate-2022-239152024-03-06vendor · osvUS

    The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

  • CVE-2022-23915Remote Code Execution (RCE)2022-03-04vendor · osvUS

    The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

  • PYSEC-2022-1622022-03-04vendor · osvUS

    Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.

  • PYSEC-2022-312022-03-04vendor · osvUS

    The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

05

also known as (9)

Other names and identifiers for this entity.

06

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvNVDCVE.orgMITRE
published 2022-03-04modified 2023-11-07
07

references

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan