by Kastro
Paper/Archive/CVE-2022-0735

CVE-2022-0735

GitLab GitLab — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 be…

EPSS 13%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 96.4.964 × 2019.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.

Affected

ProductAffectedFixed inSource
GitLab>=14.8, <14.8.2–CNA
GitLab>=14.7, <14.7.4–CNA
GitLab>=12.10, <14.6.5–CNA

Scores by source

GitLab (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgitlab.com/gitlab-org/gitlab/-/issues/353529refgitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0735.json