A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html | |
| https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json | Third Party Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/371884 | Broken Link Third Party Advisory |
| https://hackerone.com/reports/1679624 | Permissions Required Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-74 |
15 Feb 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Oct 2022, 20:09
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.9 |
19 Oct 2022, 17:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json - Third Party Advisory | |
| References | (MISC) https://hackerone.com/reports/1679624 - Permissions Required, Third Party Advisory | |
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/371884 - Broken Link, Third Party Advisory | |
| First Time |
Gitlab gitlab
Gitlab |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
|
| CWE | CWE-77 |
17 Oct 2022, 17:56
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-17 16:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-2992
Mitre link : CVE-2022-2992
CVE.ORG link : CVE-2022-2992
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')