CVE-2022-3478

{"id": "CVE-2022-3478", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-01-26T21:15:51.460", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3478.json", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/377788", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/1716296", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious nuget package."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 12.8 anteriores a 15.4.6, todas las versiones desde 15.5 anteriores a 15.5.5, todas las versiones desde 15.6 anteriores a 15.6.1. Era posible desencadenar un ataque DoS cargando un paquete nuget malicioso."}], "lastModified": "2023-02-01T17:16:36.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "70146422-EAAD-40E4-83B4-F4F438B6A512", "versionEndExcluding": "15.4.6", "versionStartIncluding": "12.8.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "3B09958F-CF8B-496E-AF31-93BD4A3BDEA5", "versionEndExcluding": "15.4.6", "versionStartIncluding": "12.8.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C2CF4BFC-D5A9-49F5-AC0E-A5978B8D8CFD", "versionEndExcluding": "15.5.5", "versionStartIncluding": "15.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "C734804C-B835-493E-8A2B-556547368D9F", "versionEndExcluding": "15.5.5", "versionStartIncluding": "15.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "B5CD27BD-9171-4958-9E31-FA35229B39E7"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "D1DA9696-F8DA-4C34-AB21-7DE509454B82"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}