CRITICAL

CVE-2022-2992

Gitlab GitLab 2022-10-17 CVSS v3.1

CVSS

9.9

Description

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

Weakness (CWE)

CWE-74 Injection

EPSS Score

86.19%

Probability of exploitation in next 30 days

99.7th percentile

References

http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json Third Party Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/371884 Broken Link, Third Party Advisory https://hackerone.com/reports/1679624 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE