VulnerabilityModified
CVE-2022-2992
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
CRITICAL 9.9EPSS 86.2%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 86.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
- CVSS 3.1
- 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 86.19% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
References
- http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.jsonThird Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/371884Broken Link, Third Party Advisory
- https://hackerone.com/reports/1679624Permissions Required, Third Party Advisory
- http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.jsonThird Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/371884Broken Link, Third Party Advisory
- https://hackerone.com/reports/1679624Permissions Required, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.