CVE-2022-3902

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-390206.1Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, CVE-2022-390216.1U-Office Force login function has an Open Redirect vulnerability. An unauthenticated remote attacker can exploit this vulnerability to redir CVE-2022-390226.5U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerab CVE-2022-390236.5U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerab CVE-2022-390246.1U-Office Force Bulletin function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vuln CVE-2022-390256.1U-Office Force PrintMessage function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this CVE-2022-390265.4U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. A remote attacker with general CVE-2022-390275.4U-Office Force Forum function has insufficient filtering for special characters. A remote attacker with general user privilege can inject Ja CVE-2022-390287.5telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff CVE-2022-390296.5Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explic CVE-2022-39034.6An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches CVE-2022-390307.5smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly