CVE-2022-0249: SSRF
Published Mar 28, 2022
·Updated
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
Affected Software
3 affected components
GitLab GitLab>=12.0<=14.5.4
GitLab GitLab>=14.6<=14.6.4
GitLab GitLab>=14.7<=14.7.1
Event History
Mar 28, 2022
CVE Published
via MITRE·06:53 PM
Data Sourced
via MITRE·06:53 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-0249?
The severity of CVE-2022-0249 is considered medium as it allows for a blind SSRF attack.
2
How do I fix CVE-2022-0249?
To fix CVE-2022-0249, upgrade GitLab to version 14.5.5 or later, 14.6.5 or later, or 14.7.2 or later.
3
What versions of GitLab are affected by CVE-2022-0249?
CVE-2022-0249 affects GitLab versions from 12.0 up to 14.7.1, excluding 14.5.5, 14.6.5, and 14.7.2.
4
What type of attack is associated with CVE-2022-0249?
CVE-2022-0249 is associated with a blind SSRF (Server-Side Request Forgery) attack.
5
Is there a workaround for CVE-2022-0249 if I cannot upgrade GitLab?
No specific workaround is recommended for CVE-2022-0249, and upgrading is the best course of action.