CVE-2022-23915
High
Description
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Weblate
PublishedMar 4, 2022
First seenMar 4, 2022
How to fix
Update
- weblate weblate4.11.1 or later
- weblate4.11.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| weblate weblate | v < 4.11.1 | 4.11.1 |
| weblatePyPI | v < 4.11.1 | 4.11.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.