CVE-2022-23643

Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code Monitoring feature where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects only the Code Monitoring feature, whereas CVE-2021-43823 also affected saved searches. A successful attack would require an authenticated bad actor to create many Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in versions 3.35.2 and 3.36.3 of Sourcegraph. Those who are unable to upgrade may disable the Code Monitor feature in their installation.

• CWE-200
• CWE-203
• CWE-203

• https://github.com/sourcegraph/sourcegraph/pull/30547Patch, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-xqv2-x6f2-w3pfIssue Tracking, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/pull/30547Patch, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-xqv2-x6f2-w3pfIssue Tracking, Third Party Advisory

Published

Feb 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23638svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross…6.1
• CVE-2022-23639crossbeam-utils provides atomics, synchronization primitives…8.1
• CVE-2022-2364A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2022-23640Excel-Streaming-Reader is an easy-to-use implementation of a…9.8
• CVE-2022-23641Discourse is an open source discussion platform. In versions…6.5
• CVE-2022-23642Sourcegraph is a code search and navigation engine. Sourcegr…8.8
• CVE-2022-23644BookWyrm is a decentralized social network for tracking read…8.8
• CVE-2022-23645swtpm is a libtpms-based TPM emulator with socket, character…5.5
• CVE-2022-23646Next.js is a React framework. Starting with version 10.0.0 a…7.5
• CVE-2022-23647Prism is a syntax highlighting library. Starting with versio…6.1
• CVE-2022-23648containerd is a container runtime available as a daemon for …7.5
• CVE-2022-23649Cosign provides container signing, verification, and storage…3.3