CVE-2022-2884 - A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

Back Back to CVE browser

CRITICAL

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

Published Oct 17, 2022

9.9

CRITICAL

CVSS 3.1

EPSS 75.72%

Description

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

Affected products

Vendor GitLab Product GitLab Default
n/a
- Version
  >=11.3.4, <15.1.5
  Status
  affected
  Constraints
  -
- Version
  >=15.2, <15.2.3
  Status
  affected
  Constraints
  -
- Version
  >=15.3, <15.3.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

n/a

Version	Status	Constraints
>=11.3.4, <15.1.5	affected	-
>=15.2, <15.2.3	affected	-
>=15.3, <15.3.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json
Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/371098
Third Party Advisory
https://hackerone.com/reports/1672388
Permissions RequiredThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json		Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/371098		Third Party Advisory
https://hackerone.com/reports/1672388		Permissions RequiredThird Party Advisory