CVE-2022-0123
published 2022-03-28CVE-2022-0123: An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL…
PriorityP434medium6.8CVSS 3.1
AVNACHPRLUINSUCHIHAN
EPSS
0.42%
33.9th percentile
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | < 14.4.5 | 14.4.5 |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.5.0 < 14.5.3 | 14.5.3 |
| gitlab | gitlab | >= 14.6.0 < 14.6.1 | 14.6.1 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
osv6.8MEDIUM
vendor_debian5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2022-0123: An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not vali
vendor_gitlab·2022-03-28·CVSS 5.9
CVE-2022-0123 [MEDIUM] CWE-295 CVE-2022-0123: An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not vali
CVE-2022-0123: An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
Debian
CVE-2022-0123: gitlab - An issue has been discovered affecting GitLab versions prior to 14.4.5, between ...
vendor_debian·2022·CVSS 5.9
CVE-2022-0123 [MEDIUM] CVE-2022-0123: gitlab - An issue has been discovered affecting GitLab versions prior to 14.4.5, between ...
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-h2r9-r9v2-fvwp: An issue has been discovered affecting GitLab versions prior to 14
ghsa_unreviewed·2022-03-29
CVE-2022-0123 [MEDIUM] CWE-295 GHSA-h2r9-r9v2-fvwp: An issue has been discovered affecting GitLab versions prior to 14
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
OSV
CVE-2022-0123: An issue has been discovered affecting GitLab versions prior to 14
osv·2022-03-28·CVSS 6.8
CVE-2022-0123 [MEDIUM] CVE-2022-0123: An issue has been discovered affecting GitLab versions prior to 14
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
Suricata
ET WEB_SPECIFIC_APPS Atlassian Bitbucket CVE-2022-1471 Vulnerable Server Detected Version 8.0 - 8.12.0
suricata·2023-12-12·CVSS 8.3
CVE-2022-1471 [HIGH] ET WEB_SPECIFIC_APPS Atlassian Bitbucket CVE-2022-1471 Vulnerable Server Detected Version 8.0 - 8.12.0
ET WEB_SPECIFIC_APPS Atlassian Bitbucket CVE-2022-1471 Vulnerable Server Detected Version 8.0 - 8.12.0
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Atlassian Bitbucket CVE-2022-1471 Vulnerable Server Detected Version 8.0 - 8.12.0"; flow:established,to_client; http.response_body; content:"Atlassian|20|Bitbucket|20 3c|span|20|"; fast_pattern; content:"data|2d|system|2d|build|2d|number|3d 22|"; within:250; content:"|22 3e 20|v8|2e|"; within:50; pcre:"/^(?:1(?:0\.[0123]|1\.[012]|2\.0|\.)|8\.[0123456]|[0234567]\.|9\.[0123])/R"; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html; reference:cve,2022-1471; classtype:
Nuclei
WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2021-25055 [MEDIUM] WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting
WordPress FeedWordPress "
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# digest: 4a0a00473045022077b81f3374cbafbd39ba6d59b941b372e30664b95ec42f2d6ddc295f49a45348022100ac74d0e7cb16c5efd771ccf1309591191d1b357a5b93c7667ecd297c8ccf8d1e:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2022-03-28
Published