{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000046.html",
  "dc:date": "2024-06-20T15:39+09:00",
  "dcterms:issued": "2022-06-17T12:26+09:00",
  "dcterms:modified": "2024-06-20T15:39+09:00",
  "description": "Gitlab contains a server-side request forgery vulnerability (CWE-918) through the Project Import feature.\r\n\r\nKanta Nishitani of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to the developer and coordinated.\r\nAfter coordination was completed, this case was reported to IPA, and JPCERT/CC coordinated with the developer for the publication under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000046.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:gitlab:gitlab",
      "@product": "GitLab",
      "@vendor": "GitLab.org",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:gitlab:gitlab",
      "@product": "GitLab",
      "@vendor": "GitLab.org",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:gitlab:gitlab",
      "@product": "GitLab",
      "@vendor": "GitLab.org",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "5.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000046",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN93667442/index.html",
      "@id": "JVN#93667442",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-0136",
      "@id": "CVE-2022-0136",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-0136",
      "@id": "CVE-2022-0136",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Gitlab vulnerable to server-side request forgery"
}