CVEvulnerability
CVE-2022-3478
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-01-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-434
Description
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious nuget package.
Affected configurations
• gitlab gitlab (>= 12.8.0 < 15.4.6)
• gitlab gitlab (>= 15.5.0 < 15.5.5)
• gitlab gitlab 15.6.0
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3478.json Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/377788 Exploit, Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/1716296 Permissions Required, Third Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3478.json Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/377788 Exploit, Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/1716296 Permissions Required, Third Party Advisory