A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3     to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from     GitHub API endpoint (CVE-2022-2884)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3     to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from     GitHub API endpoint (CVE-2022-2884)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability in GitLab CE/EE affecting all versions starting from 11.3.4 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8a0cd618-22a0-11ed-b1e7-001b217b3468 advisory.

  - Gitlab reports: Remote Command Execution via Github import (CVE-2022-2884)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257803	Linux Distros Unpatched Vulnerability : CVE-2022-2884	Nessus	Misc.	critical
187480	GitLab 11.3.4 < 15.1.5 / 15.2 < 15.2.3 / 15.3 < 15.3.1 (CVE-2022-2884)	Nessus	CGI abuses	critical
164431	GitLab 11.3.4 < 15.1.5 / 15.2 < 15.2.3 / 15.3 < 15.3.1 RCE	Nessus	CGI abuses	critical
164342	FreeBSD : Gitlab -- Remote Code Execution (8a0cd618-22a0-11ed-b1e7-001b217b3468)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2022-2884

critical

Tenable Plugins

critical

critical

critical

critical