HIGH

CVE-2022-1510

Gitlab GitLab 2022-05-11 CVSS v3.1

CVSS

7.5

Description

An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption.

Summary dbcve.org

A denial of service vulnerability in GitLab's CI Editor and CI Pipeline details page allows attackers to inject malicious text that causes uncontrolled resource consumption, potentially rendering the service unavailable.

Mitigation

Upgrade GitLab to version 14.8.6, 14.9.4, 14.10.1 or later to patch the vulnerability.

Weakness (CWE)

CWE-1333

EPSS Score

1.93%

Probability of exploitation in next 30 days

79.1th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1510.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/343276 Broken Link https://hackerone.com/reports/1353058 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE