CVE-2022-4201
published 2023-01-27CVE-2022-4201: A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.55%
41.7th percentile
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 11.3.0 < 15.4.6 | 15.4.6 |
| gitlab | gitlab | >= 15.5.0 < 15.5.5 | 15.5.5 |
| gitlab | gitlab_ce | — | — |
| gitlab | gitlab_runner | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv5.3MEDIUM
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2022-4201: A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to
vendor_gitlab·2023-01-27·CVSS 3.5
CVE-2022-4201 [LOW] CWE-918 CVE-2022-4201: A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to
CVE-2022-4201: A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
Debian
CVE-2022-4201: gitlab - A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior...
vendor_debian·2022·CVSS 3.5
CVE-2022-4201 [LOW] CVE-2022-4201: gitlab - A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior...
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-9ppv-xcv2-vhqr: A blind SSRF in GitLab CE/EE affecting all from 11
ghsa_unreviewed·2023-01-28
CVE-2022-4201 [MEDIUM] CWE-918 GHSA-9ppv-xcv2-vhqr: A blind SSRF in GitLab CE/EE affecting all from 11
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
OSV
CVE-2022-4201: A blind SSRF in GitLab CE/EE affecting all from 11
osv·2023-01-27·CVSS 5.3
CVE-2022-4201 [MEDIUM] CVE-2022-4201: A blind SSRF in GitLab CE/EE affecting all from 11
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-27
Published