CVE-2022-2992
GitLab GitHub Repo Import Deserialization Remote Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
Una vulnerabilidad en GitLab CE/EE afectando a todas las versiones desde la 11.10 anteriores a 15.1.6, desde la 15.2 hasta la 15.2.4, desde la 15.3 hasta la 15.3.2 permite a un usuario autenticado lograr la ejecución de código remota por medio del endpoint de la API Import from GitHub
An authenticated user can import a repository from GitHub into GitLab. If a user attempts to import a repo from an attacker-controlled server, the server will reply with a Redis serialization protocol object in the nested default_branch. GitLab will cache this object and then deserialize it when trying to load a user session, resulting in remote code execution.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-08-25 CVE Reserved
- 2022-10-09 First Exploit
- 2022-10-17 CVE Published
- 2024-08-03 CVE Updated
- 2024-09-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CAPEC
References (6)
| URL | Date | SRC |
|---|---|---|
| https://github.com/CsEnox/CVE-2022-2992 | 2022-10-09 | |
| https://github.com/Malwareman007/CVE-2022-2992 | 2022-10-14 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 11.10 < 15.1.6 Search vendor "Gitlab" for product "Gitlab" and version " >= 11.10 < 15.1.6" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 11.10 < 15.1.6 Search vendor "Gitlab" for product "Gitlab" and version " >= 11.10 < 15.1.6" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 15.2 < 15.2.4 Search vendor "Gitlab" for product "Gitlab" and version " >= 15.2 < 15.2.4" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 15.2 < 15.2.4 Search vendor "Gitlab" for product "Gitlab" and version " >= 15.2 < 15.2.4" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 15.3 < 15.3.2 Search vendor "Gitlab" for product "Gitlab" and version " >= 15.3 < 15.3.2" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 15.3 < 15.3.2 Search vendor "Gitlab" for product "Gitlab" and version " >= 15.3 < 15.3.2" | enterprise |
Affected
| ||||||