VulnerabilityModified
CVE-2022-2884
A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint
CRITICAL 9.9EPSS 75.7%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 75.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint
- CVSS 3.1
- 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 75.72% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
References
- http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.jsonThird Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098Third Party Advisory
- https://hackerone.com/reports/1672388Permissions Required, Third Party Advisory
- http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.jsonThird Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098Third Party Advisory
- https://hackerone.com/reports/1672388Permissions Required, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.