An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4054.json | Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/382260 | Exploit Issue Tracking Vendor Advisory |
| https://hackerone.com/reports/1758126 | Permissions Required Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Feb 2023, 17:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gitlab gitlab
Gitlab |
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/382260 - Exploit, Issue Tracking, Vendor Advisory | |
| References | (MISC) https://hackerone.com/reports/1758126 - Permissions Required, Third Party Advisory | |
| References | (CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4054.json - Vendor Advisory | |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
26 Jan 2023, 21:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-01-26 21:18
Updated : 2023-12-10 14:48
NVD link : CVE-2022-4054
Mitre link : CVE-2022-4054
CVE.ORG link : CVE-2022-4054
JSON object : View
Products Affected
gitlab
- gitlab
CWE