MEDIUM

CVE-2022-4201

Gitlab GitLab 2023-01-27 CVSS v3.1

CVSS

5.3

Description

A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.

Weakness (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

EPSS Score

0.55%

Probability of exploitation in next 30 days

44.7th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4201.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/30376 Exploit, Issue Tracking, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE