PT-2022-13211 · Gitlab · Gitlab Ce/Ee+1

Cancerzon · Published 2022-04-01 · Updated 2024-03-06 · CVE-2022-0489

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.15 and later

Description An issue has been discovered in GitLab CE/EE that allows a Denial of Service (DOS) to be triggered by using the math feature with a specific formula in issue comments.

Recommendations For GitLab CE/EE versions 8.15 and later, consider disabling the math feature in issue comments as a temporary workaround until a patch is available. Restrict access to issue comments to minimize the risk of exploitation. Avoid using the math feature with specific formulas in issue comments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BIT-GITLAB-2022-0489

CVE-2022-0489

Affected Products

Gitlab

Gitlab Ce/Ee

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0489.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/341832 · Exploit
• https://ubuntu.com/security/CVE-2022-0489 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0489 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2022-0489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0489 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0489 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0489 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0489.json · Note
• https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released · Note
• https://t.me/cibsecurity/40030 · Telegram Post
• https://hackerone.com/reports/1350793 · Note