CVE-2022-2884 | A vulnerability in GitLab CE/EE affecting all versions from … | CVSS 9.9 CRITICAL

Description

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

Metadata

CVE ID: CVE-2022-2884
State: PUBLISHED
Assigner: GitLab
Reserved: 2022-08-18 00:00 UTC
Published: 2022-10-17 00:00 UTC
Last updated: 2025-05-14 14:24 UTC
Primary CWE: CWE-78
CWE-78 Improper Neutralization of Special Elements used in a…
Vendor / Product: GitLab / GitLab
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
GitLab	GitLab	—	>=11.3.4, <15.1.5, >=15.2, <15.2.3, >=15.3, <15.3.1

Weakness (CWE)

CWE	Source	Description
—	cna	Improper neutralization of special elements used in an os command ('os command injection') in GitLab
CWE-78	adp	CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (4)