CVE-2022-3280
published 2022-11-09CVE-2022-3280: An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.52%
40.4th percentile
An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 10.1.0 < 15.3.5 | 15.3.5 |
| gitlab | gitlab | >= 15.4.0 < 15.4.4 | 15.4.4 |
| gitlab | gitlab | >= 15.5.0 < 15.5.2 | 15.5.2 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-28w5-8wm6-h27m: An open redirect in GitLab CE/EE affecting all versions from 10
ghsa_unreviewed·2022-11-10
CVE-2022-3280 [MEDIUM] CWE-601 GHSA-28w5-8wm6-h27m: An open redirect in GitLab CE/EE affecting all versions from 10
An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.
OSV
CVE-2022-3280: An open redirect in GitLab CE/EE affecting all versions from 10
osv·2022-11-09·CVSS 6.1
CVE-2022-3280 [MEDIUM] CVE-2022-3280: An open redirect in GitLab CE/EE affecting all versions from 10
An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.
GitLab
CVE-2022-3280: An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker t
vendor_gitlab·2022-11-09·CVSS 3.5
CVE-2022-3280 [LOW] CWE-601 CVE-2022-3280: An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker t
CVE-2022-3280: An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.
Debian
CVE-2022-3280: gitlab - An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3....
vendor_debian·2022·CVSS 3.5
CVE-2022-3280 [LOW] CVE-2022-3280: gitlab - An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3....
An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3280.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/352611https://hackerone.com/reports/1475686https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3280.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/352611https://hackerone.com/reports/1475686
2022-11-09
Published