CVE-2022-23915 - OpenCVE

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Weblate	Weblate

Configuration 1 [-]

cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/WeblateOrg/weblate/pull/7337
https://github.com/WeblateOrg/weblate/pull/7338
https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1
https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088

History

No history.

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-03-04T20:00:13.383792Z

Updated: 2024-09-17T00:10:54.741Z

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-23915

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-03-04T20:15:07.757

Modified: 2022-03-12T01:58:54.757

Link: CVE-2022-23915

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Weblate", "vendor": "n/a", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.11.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Alessio Della Libera of Snyk Research Team"}], "datePublic": "2022-03-04T00:00:00", "descriptions": [{"lang": "en", "value": "The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Remote Code Execution (RCE)", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-04T20:00:13", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/WeblateOrg/weblate/pull/7338"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/WeblateOrg/weblate/pull/7337"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1"}], "title": "Remote Code Execution (RCE)", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2022-03-04T20:00:01.283767Z", "ID": "CVE-2022-23915", "STATE": "PUBLIC", "TITLE": "Remote Code Execution (RCE)"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Weblate", "version": {"version_data": [{"version_affected": ">=", "version_value": "0"}, {"version_affected": "<", "version_value": "4.11.1"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Alessio Della Libera of Snyk Research Team"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote Code Execution (RCE)"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088"}, {"name": "https://github.com/WeblateOrg/weblate/pull/7338", "refsource": "MISC", "url": "https://github.com/WeblateOrg/weblate/pull/7338"}, {"name": "https://github.com/WeblateOrg/weblate/pull/7337", "refsource": "MISC", "url": "https://github.com/WeblateOrg/weblate/pull/7337"}, {"name": "https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1", "refsource": "MISC", "url": "https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:59:22.572Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/WeblateOrg/weblate/pull/7338"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/WeblateOrg/weblate/pull/7337"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2022-23915", "datePublished": "2022-03-04T20:00:13.383792Z", "dateReserved": "2022-02-24T00:00:00", "dateUpdated": "2024-09-17T00:10:54.741Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5AA9094-8C38-49F3-B1E3-AA59A60363AF", "versionEndExcluding": "4.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution."}, {"lang": "es", "value": "El paquete weblate desde la versi\u00f3n 0 y anteriores a 4.11.1 son vulnerables a una Ejecuci\u00f3n de C\u00f3digo Remota (RCE) por medio de una inyecci\u00f3n de argumentos cuando son usados repositorios git o mercurial. Los usuarios autenticados, pueden cambiar el comportamiento de la aplicaci\u00f3n de una manera no intencionada, conllevando a una ejecuci\u00f3n de comandos"}], "id": "CVE-2022-23915", "lastModified": "2022-03-12T01:58:54.757", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2022-03-04T20:15:07.757", "references": [{"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/WeblateOrg/weblate/pull/7337"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/WeblateOrg/weblate/pull/7338"}, {"source": "report@snyk.io", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "nvd@nist.gov", "type": "Primary"}]}