CVE-2022-23915

EUVD-2022-0361
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
Argument Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
snykCNA
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
Affected Products (NVD)
VendorProductVersion
weblateweblate
𝑥
< 4.11.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/WeblateOrg/weblate/pull/7337
https://github.com/WeblateOrg/weblate/pull/7338
https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1
https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088
https://github.com/WeblateOrg/weblate/pull/7337
https://github.com/WeblateOrg/weblate/pull/7338
https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1
https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088