jvndb-2022-000046
Vulnerability from jvndb
Published
2022-06-17 12:26
Modified
2024-06-20 15:39
Severity
Summary
Gitlab vulnerable to server-side request forgery
Details
Gitlab contains a server-side request forgery vulnerability (CWE-918) through the Project Import feature.
Kanta Nishitani of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to the developer and coordinated.
After coordination was completed, this case was reported to IPA, and JPCERT/CC coordinated with the developer for the publication under Information Security Early Warning Partnership.
References
Impacted products
| Vendor | Product |
|---|---|
| GitLab.org | GitLab |
| GitLab.org | GitLab |
| GitLab.org | GitLab |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000046.html",
"dc:date": "2024-06-20T15:39+09:00",
"dcterms:issued": "2022-06-17T12:26+09:00",
"dcterms:modified": "2024-06-20T15:39+09:00",
"description": "Gitlab contains a server-side request forgery vulnerability (CWE-918) through the Project Import feature.\r\n\r\nKanta Nishitani of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to the developer and coordinated.\r\nAfter coordination was completed, this case was reported to IPA, and JPCERT/CC coordinated with the developer for the publication under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000046.html",
"sec:cpe": [
{
"#text": "cpe:/a:gitlab:gitlab",
"@product": "GitLab",
"@vendor": "GitLab.org",
"@version": "2.2"
},
{
"#text": "cpe:/a:gitlab:gitlab",
"@product": "GitLab",
"@vendor": "GitLab.org",
"@version": "2.2"
},
{
"#text": "cpe:/a:gitlab:gitlab",
"@product": "GitLab",
"@vendor": "GitLab.org",
"@version": "2.2"
}
],
"sec:cvss": [
{
"@score": "5.5",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"@version": "2.0"
},
{
"@score": "5.4",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2022-000046",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN93667442/index.html",
"@id": "JVN#93667442",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2022-0136",
"@id": "CVE-2022-0136",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-0136",
"@id": "CVE-2022-0136",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Gitlab vulnerable to server-side request forgery"
}
Loading...