CVE-2022-0425

2022-04-0122:17:39

GitLab

www.cve.org

irker irc gateway

gitlab ce/ee

dns rebinding

ssrf

vulnerability

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.

CNA Affected

[
  {
    "product": "GitLab",
    "vendor": "GitLab",
    "versions": [
      {
        "status": "affected",
        "version": ">=7.9, <14.5.4"
      },
      {
        "status": "affected",
        "version": ">=14.6, <14.6.4"
      },
      {
        "status": "affected",
        "version": ">=14.7, <14.7.1"
      }
    ]
  }
]