CVE-2022-3375 — Exposure of Information Through Shell Error Message in Gitlab

CWE-535 — Exposure of Information Through Shell Error Message5 documents5 sources
Severity
3.7LOWNVD
EPSS
0.5%
top 36.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedApr 5

Description

An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible to disclose the branch names when attacker has a fork of a project that was switched to private.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages4 packages

▶NVDgitlab/gitlab11.10.0 — 15.8.5+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=11.10, <15.8.5, >=15.10, <15.10.1, >=15.9, <15.9.4+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-c3qm-r5gp-mgpm: An issue has been discovered in GitLab affecting all versions starting from 11↗2023-04-05
▶
OSV
CVE-2022-3375: An issue has been discovered in GitLab affecting all versions starting from 11↗2023-04-05
▶

📋Vendor Advisories

2
GitLab
CVE-2022-3375: An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all ve↗2023-04-05
▶
Debian
CVE-2022-3375: gitlab - An issue has been discovered in GitLab affecting all versions starting from 11.1...↗2022
▶