CVE-2022-2992
CRITICAL 9.9EPSS 86.2%
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
- Affected
- GitLab
- CVSS v3.1 NVD
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 86.19% chance of exploitation in the next 30 days, 100th percentile
- Published
- 2022-10-17
- Updated
- 2025-05-14
Proof-of-concept exploits (3)
- CsEnox/CVE-2022-2992224★ · 2022-10-09
- Malwareman007/CVE-2022-29928★ · 2022-10-14
- regret1537/Cs-cev0★ · 2023-05-03
Metasploit modules (1)
Exploit collections (1)
- 1-CVE-2022-2992 反序列化导致RCEhelloexp/0day
Security advisories
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/371884
- https://hackerone.com/reports/1679624