CVE-2022-4092

2023-01-2621:18:06

CWE-79

GitLab

web.nvd.nist.gov

cve-2022-4092

gitlab

security vulnerability

user input

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.003

Percentile

65.8%

JSON

An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input.

Affected configurations

Nvd

Vulners

Node

gitlabgitlabMatch15.6.0community

gitlabgitlabMatch15.6.0enterprise

VendorProductVersionCPE
gitlabgitlab15.6.0cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:*
gitlabgitlab15.6.0cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	15.6.0	cpe:2.3:a:gitlab:gitlab:15.6.0::::community:::
gitlab	gitlab	15.6.0	cpe:2.3:a:gitlab:gitlab:15.6.0::::enterprise:::

CNA Affected

[
  {
    "vendor": "GitLab",
    "product": "GitLab",
    "versions": [
      {
        "version": ">=15.6, <15.6.1",
        "status": "affected"
      }
    ]
  }
]