CRITICAL
CVE-2022-2884
CVSS
9.9
Description
A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint
Weakness (CWE)
CWE-78
OS Command Injection
EPSS Score
75.72%
Probability of exploitation in next 30 days
99.5th percentile
References
http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json
Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/371098
Third Party Advisory
https://hackerone.com/reports/1672388
Permissions Required, Third Party Advisory
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.