Vulnerability · Published Jan 18, 2022 · Assigned by GitLab

CVE-2022-0244

High 8.6

In plain English

A high-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)1.7%top 23.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.

Affected products (as reported)

Vendor	Product	Versions
GitLab	GitLab	>=14.6, <14.6.2>=14.5, <14.5.3

References

https://gitlab.com/gitlab-org/gitlab/-/issues/349524 x_refsource_MISC
https://hackerone.com/reports/1439593 x_refsource_MISC
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0244.json x_refsource_CONFIRM