CVSS: 9.9EPSS: 2%CPEs: 6EXPL: 2CVE-2022-2992 – GitLab GitHub Repo Import Deserialization Remote Code Execution
https://notcve.org/view.php?id=CVE-2022-2992
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint. Una vulnerabilidad en GitLab CE/EE afectando a todas las versiones desde la 11.10 anteriores a 15.1.6, desde la 15.2 hasta la 15.2.4, desde la 15.3 hasta la 15.3.2 permite a un usuario autenticado lograr la ejecución de código remota por medio del endpoint de la API Import from GitHub An authenticated user can import a repository from GitHub into GitLab. If a user attempts to import a repo from an attacker-controlled server, the server will reply with a Redis serialization protocol object in the nested default_branch. GitLab will cache this object and then deserialize it when trying to load a user session, resulting in remote code execution. • https://github.com/CsEnox/CVE-2022-2992 https://github.com/Malwareman007/CVE-2022-2992 http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json https://gitlab.com/gitlab-org/gitlab/-/issues/371884 https://hackerone.com/reports/1679624 https://github.com/redwaysecurity/CVEs/tree/main/CVE-2022-2992 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3279
https://notcve.org/view.php?id=CVE-2022-3279
An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs Una excepción no manejada en el análisis del registro de trabajos en GitLab CE/EE afectando a todas las versiones anteriores a 15.2.5, a la 15.3 anteriores a 15.3.4 y a la 15.4 anteriores a 15.4.1 permite a un atacante impedir el acceso a los registros de trabajos • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3279.json https://gitlab.com/gitlab-org/gitlab/-/issues/364249 https://hackerone.com/reports/1587261 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-3283
https://notcve.org/view.php?id=CVE-2022-3283
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage. Se ha detectado una potencial vulnerabilidad de DOS en GitLab CE/EE afectando a todas las versiones anteriores a 15.2.5, a todas las versiones a partir de 15.3 anteriores a 15.3.4, a todas las versiones a partir de 15.4 anteriores a 15.4.1 Mientras era clonado un problema con contenido especialmente diseñado añadido a la descripción podría haberse usado para desencadenar un alto uso de la CPU • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3283.json https://gitlab.com/gitlab-org/gitlab/-/issues/361982 https://hackerone.com/reports/1543718 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2931
https://notcve.org/view.php?id=CVE-2022-2931
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage. Se ha detectado una posible vulnerabilidad de DOS en GitLab CE/EE afectando todas las versiones anteriores a 15.1.6, todas las versiones a partir de 15.2 anteriores a 15.2.4 y a todas las versiones a partir de 15.3 anteriores a 15.3.2. El contenido malformado añadido a la descripción del problema podría haber sido usado para desencadenar un alto uso de la CPU • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2931.json https://gitlab.com/gitlab-org/gitlab/-/issues/361982 https://hackerone.com/reports/1543718 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3067
https://notcve.org/view.php?id=CVE-2022-3067
An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects' content given the project's ID. Se ha detectado un problema en la funcionalidad de importación de GitLab CE/EE afectando a todas las versiones a partir de 14.4 anteriores a 15.2.5, a todas las versiones a partir de 15.3 anteriores a 15.3.4, a todas las versiones a partir de 15.4 anteriores a 15.4.1. Era posible que un usuario autenticado leyera el contenido de proyectos arbitrarios dado el ID del proyecto • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3067.json https://gitlab.com/gitlab-org/gitlab/-/issues/372165 https://hackerone.com/reports/1685822 •