CVE-2022-0136
published 2022-03-28CVE-2022-0136: A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the…
PriorityP343high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.83%
53.0th percentile
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | 10.5.0 – 14.5.4 | — |
| gitlab | gitlab | 14.6 – 14.6.4 | — |
| gitlab | gitlab | 14.7.0 – 14.7.1 | — |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
osv8.1HIGH
vendor_debian5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2023-0134
vendor_chrome·2023-01-10·CVSS 8.8
CVE-2023-0134 [MEDIUM] Stable Channel Update for Desktop: CVE-2023-0134
Stable Channel Update for Desktop
CVE-2023-0134: Use after free in Cart. Reported by Chaoyuan Peng (@ret2happy) on 2022-11-17 [$2500][ 1385831 ] Medium CVE-2023-0135: Use after free in Cart
Reported by Chaoyuan Peng (@ret2happy) on 2022-11-18 [$2000][ 1356987 ] Medium CVE-2023-0136: Inappropriate implementation in Fullscreen API
Severity: medium
GitLab
CVE-2022-0136: A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack thr
vendor_gitlab·2022-03-28·CVSS 5.4
CVE-2022-0136 [MEDIUM] CWE-918 CVE-2022-0136: A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack thr
CVE-2022-0136: A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
Debian
CVE-2022-0136: gitlab - A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4...
vendor_debian·2022·CVSS 5.4
CVE-2022-0136 [MEDIUM] CVE-2022-0136: gitlab - A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4...
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-6c5h-gg2j-qp46: A vulnerability was discovered in GitLab versions 10
ghsa_unreviewed·2022-03-29
CVE-2022-0136 [HIGH] CWE-918 GHSA-6c5h-gg2j-qp46: A vulnerability was discovered in GitLab versions 10
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
OSV
CVE-2022-0136: A vulnerability was discovered in GitLab versions 10
osv·2022-03-28·CVSS 8.1
CVE-2022-0136 [HIGH] CVE-2022-0136: A vulnerability was discovered in GitLab versions 10
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
No detection rules found.
No public exploits indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0136.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/28561https://hackerone.com/reports/560658https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0136.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/28561https://hackerone.com/reports/560658
2022-03-28
Published