CVE-2022-3818

2022-11-1000:15:22

CWE-400

GitLab

web.nvd.nist.gov

cve-2022-3818

gitlab

resource consumption

denial of service

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

36.8%

JSON

An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance.

Affected configurations

Nvd

Vulners

Node

gitlabgitlabRange<15.3.5community

gitlabgitlabRange<15.3.5enterprise

gitlabgitlabRange15.4.0–15.4.4community

gitlabgitlabRange15.4.0–15.4.4enterprise

gitlabgitlabRange15.5.0–15.5.2community

gitlabgitlabRange15.5.0–15.5.2enterprise

VendorProductVersionCPE
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::community:::*
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

CNA Affected

[
  {
    "vendor": "GitLab",
    "product": "GitLab",
    "versions": [
      {
        "version": "<15.3.5",
        "status": "affected"
      },
      {
        "version": ">=15.4, <15.4.4",
        "status": "affected"
      },
      {
        "version": ">=15.5, <15.5.2",
        "status": "affected"
      }
    ]
  }
]