A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4,     and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch     would be expected. (CVE-2022-3288)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4,     and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch     would be expected. (CVE-2022-3288)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 04422df1-40d8-11ed-9be7-454b1dd82c64 advisory.

  - Gitlab reports: Denial of Service via cloning an issue Arbitrary PUT request as victim user through Sentry     error list Content injection via External Status Checks Project maintainers can access Datadog API Key     from logs Unsafe serialization of Json data could lead to sensitive data leakage Import bug allows     importing of private local git repos Maintainer can leak Github access tokens by changing integration URL     (even after 15.2.1 patch) Unauthorized users able to create issues in any project Bypass group IP     restriction on Dependency Proxy Healthcheck endpoint allow list can be bypassed when accessed over HTTP in     an HTTPS enabled system Disclosure of Todo details to guest users A user's primary email may be disclosed     through group member events webhooks Content manipulation due to branch/tag name confusion with the     default branch name Leakage of email addresses in WebHook logs Specially crafted output makes job logs     inaccessible Enforce editing approval rules on project level (CVE-2022-2882, CVE-2022-2904, CVE-2022-3018,     CVE-2022-3060, CVE-2022-3066, CVE-2022-3067, CVE-2022-3279, CVE-2022-3283, CVE-2022-3285, CVE-2022-3286,     CVE-2022-3288, CVE-2022-3291, CVE-2022-3293, CVE-2022-3325, CVE-2022-3330, CVE-2022-3351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
256553	Linux Distros Unpatched Vulnerability : CVE-2022-3288	Nessus	Misc.	medium
166142	GitLab < 15.2.5 (CVE-2022-3288)	Nessus	CGI abuses	medium
165595	FreeBSD : Gitlab -- Multiple vulnerabilities (04422df1-40d8-11ed-9be7-454b1dd82c64)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2022-3288

medium

Tenable Plugins

medium

medium

high