Detections
Analytics

CVE-2022-2992

critical

Description

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

References

https://hackerone.com/reports/1679624

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json

https://gitlab.com/gitlab-org/gitlab/-/issues/371884

http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html

Details

Source: Mitre, NVD

Published: 2022-10-17

Updated: 2023-08-08

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.93667