CVEvulnerability
CVE-2022-2884
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-10-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint
Affected configurations
• gitlab gitlab (>= 11.3.4 < 15.1.5)
• gitlab gitlab (>= 15.2 < 15.2.3)
• gitlab gitlab (>= 15.3 < 15.3.1)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html packetstormsecurity.com
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098 Third Party Advisory
- https://hackerone.com/reports/1672388 Permissions Required, Third Party Advisory
- http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html packetstormsecurity.com
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098 Third Party Advisory
- https://hackerone.com/reports/1672388 Permissions Required, Third Party Advisory