CVE-2022-4054

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=9.3, <15.4.6; >=15.5, <15.5.5; >=15.6, <15.6.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4054.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/382260Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1758126Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4054.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/382260Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1758126Permissions Required, Third Party Advisory

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-405407.8Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.CVE-2022-40557.4When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to t CVE-2022-40575.3The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.CVE-2022-40585.4The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS c CVE-2022-40599.8The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement v CVE-2022-40609.8The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any CVE-2022-406029.8A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an impr CVE-2022-406036.1A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series fir CVE-2022-406047.5In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.CVE-2022-406056.1MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th CVE-2022-406066.1MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th CVE-2022-406076.8IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and d