{"id":"CVE-2022-2884","state":"PUBLISHED","title":"A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code ex","description":"A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint","publishedAt":"2022-10-17T00:00:00.000Z","updatedAt":"2025-05-14T14:24:19.300Z","severity":{"score":9.9,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"GitLab"},"assigner":"GitLab","products":["GitLab GitLab"],"affected":[{"vendor":"GitLab","product":"GitLab","versions":[{"version":">=11.3.4, <15.1.5","status":"affected"},{"version":">=15.2, <15.2.3","status":"affected"},{"version":">=15.3, <15.3.1","status":"affected"}]}],"references":["https://gitlab.com/gitlab-org/gitlab/-/issues/371098","https://hackerone.com/reports/1672388","https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json","http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T19:50:01.354Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/2xxx/CVE-2022-2884.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-2884","state":"PUBLISHED","datePublished":"2022-10-17T00:00:00.000Z","dateUpdated":"2025-05-14T14:24:19.300Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2022-08-18T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint"}],"affected":[{"vendor":"GitLab","product":"GitLab","versions":[{"version":">=11.3.4, <15.1.5","status":"affected"},{"version":">=15.2, <15.2.3","status":"affected"},{"version":">=15.3, <15.3.1","status":"affected"}]}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/371098"},{"url":"https://hackerone.com/reports/1672388"},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json"},{"url":"http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"Improper neutralization of special elements used in an os command ('os command injection') in GitLab"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2023-04-03T00:00:00.000Z"},"credits":[{"lang":"en","value":"Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/371098","tags":["x_transferred"]},{"url":"https://hackerone.com/reports/1672388","tags":["x_transferred"]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json","tags":["x_transferred"]},{"url":"http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T00:53:00.444Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-14T14:23:51.849841Z","id":"CVE-2022-2884","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","type":"CWE","lang":"en","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-14T14:24:19.300Z"}}]}}}