CVE-2022-3060

2022-10-1716:15:22

CWE-22

GitLab

web.nvd.nist.gov

cve-2022-3060

improper control

resource identifier

error tracking

gitlab ce

gitlab ee

security vulnerability

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

39.3%

JSON

Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests

Affected configurations

Nvd

Vulners

Node

gitlabgitlabRange≤12.7.0community

gitlabgitlabRange≤12.7.0enterprise

VendorProductVersionCPE
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::community:::*
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

CNA Affected

[
  {
    "vendor": "GitLab",
    "product": "GitLab",
    "versions": [
      {
        "version": ">=15.4, <15.4.1",
        "status": "affected"
      },
      {
        "version": ">=15.3, <15.3.4",
        "status": "affected"
      },
      {
        "version": ">=12.7, <15.2.5",
        "status": "affected"
      }
    ]
  }
]