CVE-2022-2185
9.9
CRITICAL · CVSS 3.1 · EPSS 76.7% (pctl 100)
Patch early
EPSS 76.7% — above the 10% action threshold.
Description
A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.
Scoring
| CVSS | 9.9 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 76.65% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2022-07-01 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| gitlab | gitlab |
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2185.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/366088
- https://hackerone.com/reports/1609965
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2185.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/366088
- https://hackerone.com/reports/1609965
→ the Explorer · watch your stack · NVD