CVE-2022-2884
critical · 9.9A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint
9.9
CVSS
75.7%
EPSS (exploit prob.)
99th
EPSS percentile
2022-10-17
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab | >= 11.3.4, < 15.1.5 |
| gitlab | gitlab | >= 11.3.4, < 15.1.5 |
| gitlab | gitlab | >= 15.2, < 15.2.3 |
| gitlab | gitlab | >= 15.2, < 15.2.3 |
| gitlab | gitlab | >= 15.3, < 15.3.1 |
| gitlab | gitlab | >= 15.3, < 15.3.1 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098
- https://hackerone.com/reports/1672388
- http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098
- https://hackerone.com/reports/1672388
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-2884