CVE-2022-3060

Опубликовано: 17 окт. 2022

Источник: nvd

CVSS3: 7.3

EPSS Низкий

Описание

Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests

Ссылки

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3060.json
Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/365427
Broken Link
Third Party Advisory
https://hackerone.com/reports/1600343
Permissions Required
Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3060.json
Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/365427
Broken Link
Third Party Advisory
https://hackerone.com/reports/1600343
Permissions Required
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*

Версия до 12.7.0 (включая)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия до 12.7.0 (включая)

EPSS

Процентиль: 57%

0.00936

Низкий

7.3 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVE-2022-3060

CVSS3: 7.3

ubuntu

почти 4 года назад

CVE-2022-3060

CVSS3: 7.3

debian

почти 4 года назад

Improper control of a resource identifier in Error Tracking in GitLab ...

GHSA-g5cm-j62r-w7f5

CVSS3: 7.3

github

почти 4 года назад

EPSS

Процентиль: 57%

0.00936

Низкий

7.3 High

CVSS3

Дефекты

CWE-22