CVE-2022-2185

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
GitLabGitLab>=14.0, <14.10.5; >=15.0, <15.0.4; >=15.1, <15.1.1

References

Timeline

Published
Jul 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-218508.8Remote Desktop Client Remote Code Execution VulnerabilityCVE-2022-218518.8Remote Desktop Client Remote Code Execution VulnerabilityCVE-2022-218527.8Windows DWM Core Library Elevation of Privilege VulnerabilityCVE-2022-218559.0Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2022-218578.8Active Directory Domain Services Elevation of Privilege VulnerabilityCVE-2022-218587.8Windows Bind Filter Driver Elevation of Privilege VulnerabilityCVE-2022-218597.0Windows Accounts Control Elevation of Privilege VulnerabilityCVE-2022-21864.8The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin tCVE-2022-218607.0Windows AppContracts API Server Elevation of Privilege VulnerabilityCVE-2022-218617.8Task Flow Data Engine Elevation of Privilege VulnerabilityCVE-2022-218627.0Windows Application Model Core API Elevation of Privilege VulnerabilityCVE-2022-218637.0Windows StateRepository API Server file Elevation of Privilege Vulnerability
CVE-2022-2185: High severity, CVSS 8.8 | Vulnix