What is CVE-2022-23915?

CVE-2022-23915 is a high-severity vulnerability in Weblate, classified under Argument Injection. CVSS score: 7.2/10. Published 2022-03-04.

How severe is CVE-2022-23915?

High severity. CVSS v3 base score is 7.2 out of 10.

Is CVE-2022-23915 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Weblate

CVE-2022-23915

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

EPSS: 0.038 (88.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weblate
N/a Weblate — versions 0, unspecified

Weakness classification (CWE)

CWE-88 — Argument Injection

Public proof-of-concept exploits

dellalibera/dellalibera

References

report@snyk.io (Patch, Third Party Advisory, x_refsource_MISC)
report@snyk.io (Patch, Third Party Advisory, x_refsource_MISC)
report@snyk.io (Patch, Third Party Advisory, x_refsource_MISC)
report@snyk.io (Patch, Third Party Advisory, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2022-23915?: CVE-2022-23915 is a high-severity vulnerability in Weblate, classified under Argument Injection. CVSS score: 7.2/10. Published 2022-03-04.
How severe is CVE-2022-23915?: High severity. CVSS v3 base score is 7.2 out of 10.
Is CVE-2022-23915 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.