CVE-2022-1157

published 2022-04-11

CVE-2022-1157: Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes…

Priority P4 8 low 2.4 CVSS 3.1

AV N AC L PR H UI R S U C L I N A N

Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 15.10.8+ds1-2 (sid)	gitlab 15.10.8+ds1-2 (sid)
gitlab	gitlab	< 14.7.7	14.7.7
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	>= 14.8.0 < 14.8.5	14.8.5
gitlab	gitlab	>= 14.9.0 < 14.9.2	14.9.2
gitlab	gitlab_ce	—	—

CVSS provenance

nvd v3.1 2.4 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:P/I:N/A:N

osv 2.4 LOW

vendor_debian 2.6 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-532