CVE-2022-0425 — Server-Side Request Forgery in Gitlab

CWE-918 — Server-Side Request Forgery4 documents4 sources

Severity

7.6HIGHNVD

EPSS

0.2%

top 63.22%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Gitlab CE

Timeline

PublishedApr 1

Latest updateApr 3

Description

A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:HExploitability: 2.8 | Impact: 4.7

Affected Packages4 packages

▶NVDgitlab/gitlab7.9.0 — 14.7.1

▶CVEListV5gitlab/gitlab>=14.6, <14.6.4, >=14.7, <14.7.1, >=7.9, <14.5.4+2

▶gitlabgitlab/gitlab

▶gitlabgitlab/gitlab_ce

🔴Vulnerability Details

GHSA

GHSA-rfc5-457g-gpqm: A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7↗2022-04-03

▶

OSV

CVE-2022-0425: A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7↗2022-04-01

▶

📋Vendor Advisories

GitLab

CVE-2022-0425: A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Ser↗2022-04-01

▶