CVEvulnerability

CVE-2022-0123

6.8 MEDIUM Published 2022-03-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
4.9 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:N
Weaknesses
CWE-295

Description

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.

Affected configurations

• gitlab gitlab (< 14.4.5) • gitlab gitlab (>= 14.5.0 < 14.5.3) • gitlab gitlab (>= 14.6.0 < 14.6.1)

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References