An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json | Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/381895 | Exploit Issue Tracking Vendor Advisory |
| https://hackerone.com/reports/1757999 | Permissions Required Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Feb 2023, 17:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gitlab gitlab
Gitlab |
|
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.4 |
| CWE | NVD-CWE-noinfo | |
| References | (MISC) https://hackerone.com/reports/1757999 - Permissions Required, Third Party Advisory | |
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/381895 - Exploit, Issue Tracking, Vendor Advisory | |
| References | (CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json - Vendor Advisory |
26 Jan 2023, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-01-26 21:16
Updated : 2023-12-10 14:48
NVD link : CVE-2022-3902
Mitre link : CVE-2022-3902
CVE.ORG link : CVE-2022-3902
JSON object : View
Products Affected
gitlab
- gitlab
CWE