Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-3478

Good to know:

icon

Date: January 26, 2023

An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious nuget package.

Language: Ruby

Severity Score

Related Resources (8)

https://gitlab.com/gitlab-org/gitlab/-/issues/377788
https://hackerone.com/reports/1716296
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3478.json
https://people.canonical.com/~ubuntu-security/cve/CVE-2022-3478
https://nvd.nist.gov/vuln/detail/CVE-2022-3478
https://github.com/gitlabhq/gitlabhq/commit/e6572d41b847c839ce49bc022a8cd1b99216798b
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3478
https://www.mend.io/vulnerability-database/CVE-2022-3478

Severity Score

Weakness Type (CWE)

Unrestricted Upload of File with Dangerous Type

CWE-434

Top Fix

icon

Upgrade Version

Upgrade to version 15.4.6,15.5.5,15.6.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us