CVE-2022-4201: SSRF
Published Jan 27, 2023
·Updated
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
Affected Software
6 affected components
GitLab GitLab>=11.3.0<15.4.6
GitLab GitLab>=11.3.0<15.4.6
GitLab GitLab>=15.5.0<15.5.5
GitLab GitLab>=15.5.0<15.5.5
GitLab GitLab=15.6.0
GitLab GitLab=15.6.0
Event History
Jan 27, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-4201?
CVE-2022-4201 is classified as a high severity vulnerability due to its potential to allow unauthorized local connections.
2
How do I fix CVE-2022-4201?
To mitigate CVE-2022-4201, upgrade to GitLab versions 15.4.6, 15.5.5, or 15.6.1 or later.
3
What type of vulnerability is CVE-2022-4201?
CVE-2022-4201 is a blind Server-Side Request Forgery (SSRF) vulnerability.
4
Which versions of GitLab are affected by CVE-2022-4201?
CVE-2022-4201 affects GitLab versions from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1.
5
What can an attacker do with CVE-2022-4201?
An attacker can exploit CVE-2022-4201 to connect to local addresses when configuring a malicious GitLab Runner.