CVE-2022-3285 — Permissive List of Allowed Inputs in Gitlab

5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 42.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedNov 9
Latest updateNov 10

Description

Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to prevent access to GitLab

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDgitlab/gitlab12.0.0 — 15.2.5+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=12.0, <15.2.5, >=15.3, <15.3.4, >=15.4, <15.4.1+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-gchc-78gm-5379: Bypass of healthcheck endpoint allow list affecting all versions from 12↗2022-11-10
▶
OSV
CVE-2022-3285: Bypass of healthcheck endpoint allow list affecting all versions from 12↗2022-11-09
▶

📋Vendor Advisories

2
GitLab
CVE-2022-3285: Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an u↗2022-11-09
▶
Debian
CVE-2022-3285: gitlab - Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior...↗2022
▶