Ubuntu.comUB:CVE-2022-2417CVE-2022-2417
6.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
23.0%
Insufficient validation in GitLab CE/EE affecting all versions from 12.10
prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an
authenticated and authorised user to import a project that includes branch
names which are 40 hexadecimal characters, which could be abused in supply
chain attacks where a victim pinned to a specific Git commit of the
project.
Related
6.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
23.0%