CVE-2022-2185 | A critical issue has been discovered in GitLab affecting all… | CVSS 9.9 CRITICAL

Description

A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.

Metadata

CVE ID: CVE-2022-2185
State: PUBLISHED
Assigner: GitLab
Reserved: 2022-06-23 00:00 UTC
Published: 2022-07-01 15:50 UTC
Last updated: 2024-08-03 00:32 UTC
Vendor / Product: GitLab / GitLab
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
GitLab	GitLab	—	>=14.0, <14.10.5, >=15.0, <15.0.4, >=15.1, <15.1.1

Weakness (CWE)

CWE	Source	Description
—	cna	Improper neutralization of special elements used in a command ('command injection') in GitLab

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (3)