CVE-2022-0738

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Mar 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-07399.8The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constrCVE-2022-07404.3Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 beCVE-2022-07417.5Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables vCVE-2022-07427.5Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 pacCVE-2022-07434.6Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.CVE-2022-07456.5The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipiCVE-2022-07464.3Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.CVE-2022-07479.8The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement viCVE-2022-07489.8The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javaCVE-2022-07499.8This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable iCVE-2022-07505.4The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the tCVE-2022-07518.8Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with
CVE-2022-0738: High severity, CVSS 7.5 | Vulnix