Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.9
CVSSv3

CVE-2022-2884

Published: 17/10/2022 Updated: 03/04/2023
CVSS v3 Base Score: 9.9 | Impact Score: 6 | Exploitability Score: 3.1
VMScore: 0

Vulnerability Summary

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 before 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

gitlab gitlab

Github Repositories

https://github.com/chftm/nto-cs-2024

Райтапы НТО ИБ 2024

Web3 В коде сервера сразу заметна потенциальная уязвимость SSTI на эндпоинте /flag Однако так просто получить к нему доступ нельзя: В haproxycfg видно, что прокси блокирует все запросы, начинающиеся с /flag: Пробуем обой

References

CWE-78https://hackerone.com/reports/1672388https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/371098http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.htmlhttps://nvd.nist.govhttps://github.com/chftm/nto-cs-2024
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-40673CVE-2024-36674CVE-2024-27348unspecifiedCVE-2024-24919CVE-2024-4870malicious code‎CVE-2024-2019hard-coded
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook