{"id":20373,"date":"2022-07-03T07:04:00","date_gmt":"2022-07-03T07:04:00","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=20373"},"modified":"2026-04-17T18:07:44","modified_gmt":"2026-04-17T18:07:44","slug":"multiple-high-risk-vulnerability-alerts-of-gitlab","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/multiple-high-risk-vulnerability-alerts-of-gitlab\/","title":{"rendered":"Multiple High-Risk Vulnerability Alerts of GitLab"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

On July 1, 2022, NSFOCUS CERT detected that GitLab officially released a security bulletin and fixed multiple security vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Please take measures to protect it as soon as possible.<\/p>\n\n\n\n

GitLab Remote Code Execution Vulnerability (CVE-2022-2185):<\/strong><\/p>\n\n\n\n

A remote code execution vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) that could allow an authenticated attacker to import a malicious project and eventually execute arbitrary code on the target server. The CVSS score was 9.9.<\/p>\n\n\n\n

GitLab Cross-Site Scripting (XSS) Vulnerability (CVE-2022-2235):<\/strong><\/p>\n\n\n\n

GitLab Enterprise Edition (EE) has an XSS vulnerability that could be successfully exploited by an authenticated attacker by tricking a user into clicking on a specially crafted malicious file. The CVSS score was 8.7.<\/p>\n\n\n\n

GitLab Stored XSS Vulnerability (CVE-2022-2230):<\/strong><\/p>\n\n\n\n

A stored XSS vulnerability exists in the settings page of GitLab Community Edition (CE) and Enterprise Edition (EE), which could be exploited by an attacker with high privileges to execute arbitrary JavaScript code in GitLab on behalf of the victim. The CVSS score was 8.1.<\/p>\n\n\n\n

GitLab Improper Authorization Vulnerability (CVE-2022-2229):<\/strong><\/p>\n\n\n\n

An improper authorization vulnerability exists in the settings page of GitLab Community Edition (CE) and Enterprise Edition (EE), which allows an unauthenticated attacker to extract a known name of the attacker in the public or private project to which they belong, without ignoring them. The value of the protected variable. The CVSS score was 7.5.<\/p>\n\n\n\n

GitLab is an open source project developed by GitLab Inc. for a warehouse management system that uses Git as a code management tool to access public or private projects through a web interface.<\/p>\n\n\n\n

Reference link:<\/p>\n\n\n\n

https:\/\/about.gitlab.com\/releases\/2022\/06\/30\/critical-security-release-gitlab-15-1-1-released\/<\/a><\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected version<\/strong><\/p>\n\n\n\n

CVE-2022-2185:<\/p>\n\n\n\n