CVE-2022-2992 | A vulnerability in GitLab CE/EE affecting all versions from … | CVSS 9.9 CRITICAL

Description

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

Metadata

CVE ID: CVE-2022-2992
State: PUBLISHED
Assigner: GitLab
Reserved: 2022-08-25 00:00 UTC
Published: 2022-10-17 00:00 UTC
Last updated: 2025-05-14 14:27 UTC
Primary CWE: CWE-74
CWE-74 Improper Neutralization of Special Elements in Output…
Vendor / Product: GitLab / GitLab
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
GitLab	GitLab	—	>=11.10, <15.1.6, >=15.2, <15.2.4, >=15.3, <15.3.2

Weakness (CWE)

CWE	Source	Description
—	cna	Improper neutralization of special elements used in a command ('command injection') in GitLab
CWE-74	adp	CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (4)