A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5,     all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning     an issue with special crafted content added to the description could have been used to trigger high CPU     usage. (CVE-2022-3283)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5,     all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning     an issue with special crafted content added to the description could have been used to trigger high CPU     usage. (CVE-2022-3283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 04422df1-40d8-11ed-9be7-454b1dd82c64 advisory.

  - Gitlab reports: Denial of Service via cloning an issue Arbitrary PUT request as victim user through Sentry     error list Content injection via External Status Checks Project maintainers can access Datadog API Key     from logs Unsafe serialization of Json data could lead to sensitive data leakage Import bug allows     importing of private local git repos Maintainer can leak Github access tokens by changing integration URL     (even after 15.2.1 patch) Unauthorized users able to create issues in any project Bypass group IP     restriction on Dependency Proxy Healthcheck endpoint allow list can be bypassed when accessed over HTTP in     an HTTPS enabled system Disclosure of Todo details to guest users A user's primary email may be disclosed     through group member events webhooks Content manipulation due to branch/tag name confusion with the     default branch name Leakage of email addresses in WebHook logs Specially crafted output makes job logs     inaccessible Enforce editing approval rules on project level (CVE-2022-2882, CVE-2022-2904, CVE-2022-3018,     CVE-2022-3060, CVE-2022-3066, CVE-2022-3067, CVE-2022-3279, CVE-2022-3283, CVE-2022-3285, CVE-2022-3286,     CVE-2022-3288, CVE-2022-3291, CVE-2022-3293, CVE-2022-3325, CVE-2022-3330, CVE-2022-3351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
257495	Linux Distros Unpatched Vulnerability : CVE-2022-3283	Nessus	Misc.	Local	high
166321	GitLab < 15.2.5 (CVE-2022-3283)	Nessus	CGI abuses	Combined	high
165595	FreeBSD : Gitlab -- Multiple vulnerabilities (04422df1-40d8-11ed-9be7-454b1dd82c64)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2022-3283

high

Tenable Plugins

high

high

high