8.8

CVE-2022-23915

Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Weblate ≫ Weblate Version < 4.11.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.86% 0.849
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
report@snyk.io 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

https://github.com/WeblateOrg/weblate/pull/7337
Patch
Third Party Advisory
https://github.com/WeblateOrg/weblate/pull/7338
Patch
Third Party Advisory
https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1
Patch
Third Party Advisory
Release Notes
https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088
Patch
Third Party Advisory