PT-2022-12999 · Gitlab · Gitlab

Aryan2808 · Published 2022-01-18 · Updated 2024-03-06 · CVE-2022-0154

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab versions 7.7 through 14.4.4 GitLab versions 14.5.0 through 14.5.2 GitLab versions 14.6.0 through 14.6.1

Description The issue allows a malicious user to perform a Cross-Site Request Forgery attack, enabling them to import their GitHub project into another GitLab user's account.

Recommendations For GitLab versions 7.7 through 14.4.4, update to version 14.4.5 or later. For GitLab versions 14.5.0 through 14.5.2, update to version 14.5.3 or later. For GitLab versions 14.6.0 through 14.6.1, update to version 14.6.2 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-GITLAB-2022-0154

CVE-2022-0154

Affected Products

Gitlab

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0154.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-0154 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-0154 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0154 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0154 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0154 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2022-0154 · Vendor Advisory
• https://hackerone.com/reports/605576 · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/29580 · Note
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json · Note