CVE-2022-1428 describes a vulnerability in GitLab, affecting all versions before 14.8.6, 14.9 before 14.9.4, and 14.10 before 14.10.1. The issue stems from incorrect verification of throttling limits for authenticated package requests, leading to these limits not being enforced. Rated with a CVSS score of 4.3 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring low privileges. Its potential impact is limited to availability (A:L), as it allows for resource exhaustion. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. While there is limited community discussion and media coverage, GitLab has released security updates to address this flaw.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 14.8.6CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
< 14.8.6CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 14.9.0, < 14.9.4CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 14.9.0, < 14.9.4CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
14.10.0CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:14.10.0:*:*:*:community:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.