CVE-2022-2992: Command Injection
Published Oct 17, 2022
·Updated
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
Affected Software
6 affected components
GitLab GitLab>=11.10<15.1.6
GitLab GitLab>=11.10<15.1.6
GitLab GitLab>=15.2<15.2.4
GitLab GitLab>=15.2<15.2.4
GitLab GitLab>=15.3<15.3.2
GitLab GitLab>=15.3<15.3.2
Event History
Oct 17, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-2992?
CVE-2022-2992 has a high severity rating as it allows authenticated users to achieve remote code execution.
2
How do I fix CVE-2022-2992?
To fix CVE-2022-2992, upgrade to GitLab versions 15.1.6, 15.2.4, or 15.3.2 or later.
3
Which versions of GitLab are affected by CVE-2022-2992?
CVE-2022-2992 affects all GitLab CE/EE versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2.
4
Can CVE-2022-2992 be exploited remotely?
Yes, CVE-2022-2992 can be exploited remotely by authenticated users leveraging the Import from GitHub API endpoint.
5
What types of GitLab installations are impacted by CVE-2022-2992?
Both GitLab Community Edition (CE) and Enterprise Edition (EE) installations are impacted by CVE-2022-2992.