CRITICAL

CVE-2022-1162

Gitlab GitLab 2022-04-04 CVSS v3.1

CVSS

9.8

Description

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts

Weakness (CWE)

CWE-798 Hard-coded Credentials

EPSS Score

76.18%

Probability of exploitation in next 30 days

99.5th percentile

References

http://packetstormsecurity.com/files/166828/Gitlab-14.9-Authentication-Bypass.html Third Party Advisory, VDB Entry https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1162.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/357210 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE