https://hackerone.com/reports/1286317

https://gitlab.com/gitlab-org/gitlab/-/issues/337601

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0741.json

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2823048d-9f8f-11ec-8c9c-001b217b3468 advisory.

  - Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows     an attacker to create Snippets with misleading content which could trick unsuspecting users into executing     arbitrary commands (CVE-2022-0751)

  - An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8     to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to     unauthenticated users through the GraphQL API. (CVE-2021-4191)

  - An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible     to trigger a DOS by using the math feature with a specific formula in issue comments. (CVE-2022-0489)

  - An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting     from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab     REST API may allow unprivileged users to add other users to groups even if that is not possible to do     through the Web UI. (CVE-2022-0549)

  - An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all     versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised     user was able to steal runner registration tokens through an information disclosure vulnerability using     quick actions commands. (CVE-2022-0735)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of GitLab running on the remote web server is prior to 12.10.x prior to 14.6.5, 14.7.x prior to 14.7.4, or 14.8.x prior to 14.8.2. It is, therefore, affected by the following vulnerabilities:

  - An unauthorized user can steal runner registration tokens using an information disclosure vulnerability by     using quick commands. (CVE-2022-0735)

  - An unauthorized user can steal environment variables using specially crafted email addresses due to     improper input validation in sendmail. (CVE-2022-0741)

  - An unauthorized user can trick users into executing arbitrary commands due to inaccurate display of     Snippet files with special characters. (CVE-2022-0751)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
158782	FreeBSD : Gitlab -- multiple vulnerabilities (2823048d-9f8f-11ec-8c9c-001b217b3468)	Nessus	FreeBSD Local Security Checks	critical
158560	GitLab 12.10.x < 14.6.5 / 14.7.x < 14.7.4 / 14.8.x < 14.8.2 Multiple Vulnerabilities	Nessus	CGI abuses	critical

CVE-2022-0741

high

Tenable Plugins

critical

critical