CVE-2022-2185 is a critical remote code execution (RCE) vulnerability affecting GitLab versions 14.0 through 14.10.4, 15.0 through 15.0.3, and 15.1 through 15.1.0. An authenticated user with project import privileges can exploit this by importing a maliciously crafted project. This vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk. It has a low attack complexity and requires only low privileges, allowing an attacker to achieve full confidentiality, integrity, and availability compromise. Its EPSS score of 0.90932 and FAUCET Risk Score of 100/100 highlight its significant exploitability. While not yet listed in CISA's KEV catalog, there is a high level of community attention with 12 mentions, and Nuclei templates for exploitation are publicly available. This suggests a strong likelihood of active exploitation in the near future.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 14.0.0, < 14.10.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 14.0.0, < 14.10.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 15.0.0, < 15.0.4CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 15.0.0, < 15.0.4CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
15.1.0CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:15.1.0:*:*:*:community:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.