Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-2884

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

Published

2022-10-17T16:15:21.453

Last Modified

2025-05-14T15:15:48.923

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.9 (CRITICAL)

Weaknesses

Type: Primary
CWE-78
Type: Secondary
CWE-78

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	gitlab	gitlab	< 15.1.5	Yes
Application	gitlab	gitlab	< 15.1.5	Yes
Application	gitlab	gitlab	< 15.2.3	Yes
Application	gitlab	gitlab	< 15.2.3	Yes
Application	gitlab	gitlab	< 15.3.1	Yes
Application	gitlab	gitlab	< 15.3.1	Yes

References

http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html ([email protected])
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json Third Party Advisory ([email protected])
https://gitlab.com/gitlab-org/gitlab/-/issues/371098 Third Party Advisory ([email protected])
https://hackerone.com/reports/1672388 Permissions Required, Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html (af854a3a-2127-422b-91ae-364da2661108)
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://gitlab.com/gitlab-org/gitlab/-/issues/371098 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/1672388 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)