CVE-2022-2992

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-299227.5Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect da CVE-2022-299234.8Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This CVE-2022-299257.8Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.CVE-2022-299276.1In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible CVE-2022-299284.9In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible CVE-2022-299296.1In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible CVE-2022-29939.8There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirement CVE-2022-299304.9SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1.CVE-2022-299316.1The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XS CVE-2022-299327.5The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the cont CVE-2022-299338.8Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password an CVE-2022-299347.8USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE