PT-2022-13691 · Gitlab · Gitlab Ce/Ee+1
Scaramouche31
·
Published
2022-04-04
·
Updated
2024-03-06
·
CVE-2022-1174
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Gitlab CE/EE versions 13.7 through 14.7.7
Gitlab CE/EE versions 14.8 through 14.8.5
Gitlab CE/EE versions 14.9 through 14.9.2
Description
A potential DoS issue was discovered, allowing an attacker to trigger high CPU usage via a specially crafted input added in various features such as Issues, Merge requests, Milestones, Snippets, Wiki pages, etc.
Recommendations
For versions 13.7 through 14.7.7, update to version 14.7.7 or later to resolve the issue.
For versions 14.8 through 14.8.5, update to version 14.8.5 or later to resolve the issue.
For versions 14.9 through 14.9.2, update to version 14.9.2 or later to resolve the issue.
As a temporary workaround, consider restricting the ability to add specially crafted inputs in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc., until a patch is available.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitlab
Gitlab Ce/Ee