by Kastro
Paper/Archive/CVE-2022-2185

CVE-2022-2185

GitLab GitLab — A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1…

EPSS 77%CVSS 9.9
critical.is priorityof 100
50
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 99.5.995 × 2019.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.

Affected

ProductAffectedFixed inSource
GitLab>=14.0, <14.10.5–CNA
GitLab>=15.0, <15.0.4–CNA
GitLab>=15.1, <15.1.1–CNA

Scores by source

GitLab (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refgitlab.com/gitlab-org/gitlab/-/issues/366088refhackerone.com/reports/1609965refgitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2185.json