An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json | Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/381895 | Exploit Issue Tracking Vendor Advisory |
| https://hackerone.com/reports/1757999 | Permissions Required Third Party Advisory |
| https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json | Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/381895 | Exploit Issue Tracking Vendor Advisory |
| https://hackerone.com/reports/1757999 | Permissions Required Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:20
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json - Vendor Advisory | |
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/381895 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://hackerone.com/reports/1757999 - Permissions Required, Third Party Advisory |
Information
Published : 2023-01-26 21:16
Updated : 2024-11-21 07:20
NVD link : CVE-2022-3902
Mitre link : CVE-2022-3902
CVE.ORG link : CVE-2022-3902
JSON object : View
Products Affected
gitlab
- gitlab
CWE