CVE-2022-0090: Medium severity gitlab vulnerability
Published Jan 18, 2022
·Updated
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI.
Affected Software
6 affected components
GitLab GitLab<14.4.5
GitLab GitLab<14.4.5
GitLab GitLab>=14.5.0<14.5.3
GitLab GitLab>=14.5.0<14.5.3
GitLab GitLab>=14.6.0<14.6.1
GitLab GitLab>=14.6.0<14.6.1
Event History
Jan 18, 2022
CVE Published
via MITRE·04:52 PM
Data Sourced
via MITRE·04:52 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-0090?
CVE-2022-0090 is considered a medium severity vulnerability.
2
How do I fix CVE-2022-0090?
To fix CVE-2022-0090, you should upgrade GitLab to version 14.4.5 or later.
3
What versions of GitLab are affected by CVE-2022-0090?
CVE-2022-0090 affects GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1.
4
What kind of attack does CVE-2022-0090 enable?
CVE-2022-0090 allows a malicious user to spoof the contents of their commits in GitLab.
5
Is GitLab Community Edition affected by CVE-2022-0090?
Yes, both GitLab Community Edition and Enterprise Edition are affected by CVE-2022-0090.