Lucene search

Ubuntu.comUB:CVE-2022-4335

HistoryJan 27, 2023 - 12:00 a.m.

CVE-2022-4335

2023-01-2700:00:00

ubuntu.com

cve-2022-4335

ssrf vulnerability

gitlab ee

version 15.4.6

version 15.5.5

version 15.6.1

enterprise edition

localhost connection

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

30.0%

JSON

A blind SSRF vulnerability was identified in all versions of GitLab EE
prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which
allows an attacker to connect to a local host.

Notes

Author	Note
alexmurray	Only affects Gitlab Enterprise Edition, not gitlab in Ubuntu

References

gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4335.json

gitlab.com/gitlab-org/gitlab/-/issues/353018

hackerone.com/reports/1462437

launchpad.net/bugs/cve/CVE-2022-4335

nvd.nist.gov/vuln/detail/CVE-2022-4335

security-tracker.debian.org/tracker/CVE-2022-4335

www.cve.org/CVERecord?id=CVE-2022-4335

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

30.0%

JSON

Related for UB:CVE-2022-4335