MEDIUM

CVE-2022-3902

Gitlab GitLab 2023-01-26 CVSS v3.1

CVSS

6.4

Description

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.

Weakness (CWE)

CWE-532 Sensitive Information in Logs

EPSS Score

0.73%

Probability of exploitation in next 30 days

52.6th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/381895 Exploit, Issue Tracking, Vendor Advisory https://hackerone.com/reports/1757999 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE