6.8

CVE-2022-0123

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ GitLab Version < 14.4.5
Gitlab ≫ GitLab Version >= 14.5.0 < 14.5.3
Gitlab ≫ GitLab Version >= 14.6.0 < 14.6.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.44% 0.365
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 1.6 5.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NIST 4.9 6.8 4.9
AV:N/AC:M/Au:S/C:P/I:P/A:N
cve@gitlab.com 5.9 0.7 5.2
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/296632
Broken Link