CVE-2022-0249
published 2022-03-28CVE-2022-0249: A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not…
PriorityP344critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.12%
62.2th percentile
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | 12.0 – 14.5.4 | — |
| gitlab | gitlab | 14.6 – 14.6.4 | — |
| gitlab | gitlab | 14.7 – 14.7.1 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv9.1CRITICAL
vendor_debian3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2022-0249: A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space
vendor_gitlab·2022-03-28·CVSS 3.1
CVE-2022-0249 [LOW] CWE-918 CVE-2022-0249: A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space
CVE-2022-0249: A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
Debian
CVE-2022-0249: gitlab - A vulnerability was discovered in GitLab starting with version 12. GitLab was vu...
vendor_debian·2022·CVSS 3.1
CVE-2022-0249 [LOW] CVE-2022-0249: gitlab - A vulnerability was discovered in GitLab starting with version 12. GitLab was vu...
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-q7f8-fr48-qw7g: A vulnerability was discovered in GitLab starting with version 12
ghsa_unreviewed·2022-03-29
CVE-2022-0249 [CRITICAL] CWE-918 GHSA-q7f8-fr48-qw7g: A vulnerability was discovered in GitLab starting with version 12
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
OSV
CVE-2022-0249: A vulnerability was discovered in GitLab starting with version 12
osv·2022-03-28·CVSS 9.1
CVE-2022-0249 [CRITICAL] CVE-2022-0249: A vulnerability was discovered in GitLab starting with version 12
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0249.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/29395https://hackerone.com/reports/579934https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0249.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/29395https://hackerone.com/reports/579934
2022-03-28
Published