CVE-2022-4054 Affecting gitlab package, versions <15.10.8+ds1-2


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.06% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-GITLAB-3151781
  • published1 Dec 2022
  • disclosed26 Jan 2023

Introduced: 1 Dec 2022

CVE-2022-4054  (opens in a new tab)

How to fix?

Upgrade Debian:unstable gitlab to version 15.10.8+ds1-2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gitlab package and not the gitlab package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.

CVSS Scores

version 3.1