CVE-2022-2992 in the critical feed json
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated u…
published 2022-10-17 4 y ago modified 2026-09-08 2 mo ago also BIT-gitlab-2022-2992 , EUVD-2022-35210
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 86.2%
- EPSS 86.2% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 1
- Metasploit
Summary
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
Patch / fix
- bitnami gitlab 15.1.6, 15.2.4, 15.3.2
- gitlab gitlab 15.1.6, 15.2.4, 15.3.2
- gitlab gitlab_enterprise 15.1.6, 15.2.4, 15.3.2
Timeline
- First public exploit (Metasploit exploit/multi/http/gitlab_github_import_rce_cve_2022_2992)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 17 mo ago
Exploit prediction
86.19% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/gitlab_github_import_rce_cve_2022_2992 GitLab GitHub Repo Import Deserialization RCE metasploit exploit, excellent rank, 2022-10-06
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| OSV | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | gitlab | >=11.10.0, <15.1.6 >=15.2.0, <15.2.4 >=15.3.0, <15.3.2 |
15.1.6 15.2.4 15.3.2 |
Affected products
- GitLab GitLab
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
- Technology feeds
References
-
gitlab.com
/gitlab-org/gitlab/-/issues/371884
broken-link, third-party-advisory, advisory
-
hackerone.com
/reports/1679624
permissions-required, third-party-advisory, advisory
-
gitlab.com
/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json
third-party-advisory, advisory
-
packetstormsecurity.com
/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-2992
web
Sources
- CVE List CVE-2022-2992
- NVD CVE-2022-2992
- OSV BIT-gitlab-2022-2992
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Enhance with deb and rpm package type records.