CVE-2022-2882: Medium severity gitlab vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A malicious maintainer could exfiltrate a GitHub integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2882?
CVE-2022-2882 is considered to be a high severity vulnerability due to the risk of unauthorized access to sensitive GitHub integration tokens.
How do I fix CVE-2022-2882?
To remediate CVE-2022-2882, update GitLab to version 15.2.5 or later, version 15.3.4 or later, or version 15.4.1 or later.
Who is affected by CVE-2022-2882?
CVE-2022-2882 affects all versions of GitLab CE and EE from 12.6 up to but not including 15.2.5, as well as specific versions 15.3 and 15.4.
What can a malicious maintainer do with CVE-2022-2882?
A malicious maintainer could exfiltrate a GitHub integration's access token through modification of the integration settings.
What is the impact of CVE-2022-2882?
The impact of CVE-2022-2882 includes potential unauthorized access to users' GitHub accounts through the compromised access tokens.