CVE-2021-43823

Katalog CVE

CVSS 6.5 · Medium EPSS 0,87%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada sourcegraph. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searches and Code Monitoring features. A successful attack would require an authenticated bad actor to create many Saved Searches or Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in version 3.33.2 and any future versions of Sourcegraph. We strongly encourage upgrading to secure versions. If you are unable to, you may disable Saved Searches and Code Monitors.

Rincian

Terbit di NVD

13 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,87% peluang dieksploitasi; lebih tinggi dari 57,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sourcegraph/sourcegraph/commit/a88d90a8302c492282186d39718cd8fb093c14fa patch · advisory pihak ketiga
• https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-cpq7-hmvv-29w9 advisory pihak ketiga