CVE-2022-3902

Опубликовано: 26 янв. 2023

Источник: nvd

CVSS3: 5.5

CVSS3: 6.4

EPSS Низкий

Описание

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.

Ссылки

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/381895
Exploit
Issue Tracking
Vendor Advisory
https://hackerone.com/reports/1757999
Permissions Required
Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/381895
Exploit
Issue Tracking
Vendor Advisory
https://hackerone.com/reports/1757999
Permissions Required
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*

Версия от 9.3.0 (включая) до 15.4.6 (исключая)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия от 9.3.0 (включая) до 15.4.6 (исключая)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*

Версия от 15.5.0 (включая) до 15.5.5 (исключая)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия от 15.5.0 (включая) до 15.5.5 (исключая)

cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:*

cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:*

EPSS

Процентиль: 45%

0.00223

Низкий

5.5 Medium

CVSS3

6.4 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-532

Связанные уязвимости

CVE-2022-3902

CVSS3: 5.5

ubuntu

около 3 лет назад

CVE-2022-3902

CVSS3: 5.5

debian

около 3 лет назад

An issue has been discovered in GitLab affecting all versions starting ...

GHSA-hv57-5vj6-78w5

CVSS3: 6.4

github

около 3 лет назад

EPSS

Процентиль: 45%

0.00223

Низкий

5.5 Medium

CVSS3

6.4 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-532