← Vulnerability feed

Vulnerability record · CVE-2021-43823 · published 13 December 2021

CVE-2021-43823: Sourcegraph information exposure vulnerability

Sourcegraph · Sourcegraph

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searches and Code Monitoring features. A successful attack would require an authenticated bad actor to create many Saved Searches or Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in version 3.33.2 and any future versions of Sourcegraph. We strongly encourage upgrading to secure versions. If you are unable to, you may disable Saved Searches and Code Monitors.

6.5 CVSS 3.1 Medium EPSS 0.84% · top 43.9% CWE-200 · Information exposureCWE-203 · Observable discrepancy
6.5CVSS 3.1 base score, v2 4.0
0.84%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searches and Code Monitoring features. A successful attack would require an authenticated bad actor to create many Saved Searches or Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in version 3.33.2 and any future versions of Sourcegraph. We strongly encourage upgrading to secure versions. If you are unable to, you may disable Saved Searches and Code Monitors.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/sourcegraph/sourcegraph/commit/a88d90a8302c492282186d39718cd8fb093c14fa PatchThird Party Advisory
https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-cpq7-hmvv-29w9 Third Party Advisory
https://github.com/sourcegraph/sourcegraph/commit/a88d90a8302c492282186d39718cd8fb093c14fa PatchThird Party Advisory
https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-cpq7-hmvv-29w9 Third Party Advisory

Track CVE-2021-43823 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2022-23642Sourcegraph gitserver git config injection enables remote code executionSourcegraph before 3.37 fails to restrict calls to `git config` in its gitserver service, which acts as a git exec proxy. An attacker can set the `co…EPSS 74%analysed7.8CVE-2022-41942Sourcegraph improper input validation vulnerabilitySourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present i…EPSS 2.8%7.2CVE-2022-41943Sourcegraph incorrect default permissions vulnerabilitysourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `custom…EPSS 1.8%7.2CVE-2022-29171Sourcegraph injection vulnerabilitySourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserv…EPSS 1.4%6.5CVE-2022-23643Sourcegraph information exposure vulnerabilitySourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity i…EPSS 0.80%6.1CVE-2020-12283Sourcegraph open redirect vulnerabilitySourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/…EPSS 1.3%4.3CVE-2022-31154Sourcegraph incorrect authorization vulnerabilitySourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned …EPSS 0.49%4.3CVE-2022-31155Sourcegraph incorrect authorization vulnerabilitySourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other…EPSS 0.49%

Source: NIST National Vulnerability Database (record CVE-2021-43823), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.