CVE-2022-0123

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:N

Exploitability : 6.8 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/296632	Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/296632	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab::::::::
	cpe:2.3:a:gitlab:gitlab::::::::
	cpe:2.3:a:gitlab:gitlab::::::::

History

21 Nov 2024, 06:37

Type	Values Removed	Values Added
CVSS	v2 : ~~4.9~~ v3 : ~~6.8~~	v2 : 4.9 v3 : 5.9
References	~~() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json - Vendor Advisory~~	() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json - Vendor Advisory
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/296632 - Broken Link~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/296632 - Broken Link

Information

Published : 2022-03-28 19:15

Updated : 2024-11-21 06:37

NVD link : CVE-2022-0123

Mitre link : CVE-2022-0123

CVE.ORG link : CVE-2022-0123

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2022-0123", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "published": "2022-03-28T19:15:08.147", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/296632", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/296632", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services."}, {"lang": "es", "value": "Se ha detectado un problema afectando las versiones de GitLab anteriores a 14.4.5, entre la 14.5.0 y la 14.5.3, y entre la 14.6.0 y la 14.6.1. GitLab no comprueba los certificados SSL para algunos de los servicios externos de CI, lo que hace posible llevar a cabo ataques MitM en las conexiones a estos servicios externos"}], "lastModified": "2024-11-21T06:37:57.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F63AB5F-A74D-4549-9D70-624BB8D14BF1", "versionEndExcluding": "14.4.5"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E06B612-B21F-4464-AF54-27EB09594216", "versionEndExcluding": "14.5.3", "versionStartIncluding": "14.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6705A81F-BEB2-4F46-B3B4-252DAA706755", "versionEndExcluding": "14.6.1", "versionStartIncluding": "14.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}