CVE-2022-0154: CSRF
First published: Tue Jan 18 2022(Updated: )
An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=7.7<14.4.5 | |
| GitLab | >=7.7<14.4.5 | |
| GitLab | >=14.5.0<14.5.3 | |
| GitLab | >=14.5.0<14.5.3 | |
| GitLab | >=14.6.0<14.6.2 | |
| GitLab | >=14.6.0<14.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-0154?
CVE-2022-0154 has been classified as a medium severity vulnerability due to the potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2022-0154?
To fix CVE-2022-0154, users should upgrade to GitLab versions 14.4.5 or later, 14.5.3 or later, or 14.6.2 or later.
What types of attacks can CVE-2022-0154 enable?
CVE-2022-0154 enables Cross-Site Request Forgery attacks that could allow malicious users to execute unauthorized commands in the GitLab application.
Which versions of GitLab are affected by CVE-2022-0154?
CVE-2022-0154 affects all GitLab versions from 7.7 up to 14.4.5, 14.5.0 up to 14.5.3, and 14.6.0 up to 14.6.2.
Is CVE-2022-0154 applicable to both community and enterprise versions of GitLab?
Yes, CVE-2022-0154 is applicable to both community and enterprise versions of GitLab.
- agent/type
- agent/references
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/7.7
- version/gitlab/14.5.0
- version/gitlab/14.6.0