Vulnerability CVE-2022-1157 - CERT Civis.Net

Vulnerability Name:

CVE-2022-1157 (CCN-223279)

Assigned:

2022-03-31

Published:

2022-03-31

Updated:

2022-04-18

Summary:

Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged

CVSS v3 Severity:

2.4 Low (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N)
2.1 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N)
2.3 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): High User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

1.7 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:M/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): Multiple_Instances
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2022-1157

Source: CCN
Type: GitLab Web site
GitLab Critical Security Release: 14.9.2, 14.8.5, and 14.7.7

Source: XF
Type: UNKNOWN
gitlab-cve20221157-info-disc(223279)

Source: CONFIRM
Type: Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1157.json

Source: MISC
Type: Broken Link
https://gitlab.com/gitlab-org/gitlab/-/issues/37261

Vulnerable Configuration:

Configuration 1:

cpe:/a:gitlab:gitlab:*:*:*:*:community:*:*:* (Version < 14.7.7)

OR cpe:/a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* (Version < 14.7.7)

OR cpe:/a:gitlab:gitlab:*:*:*:*:community:*:*:* (Version >= 14.8.0 and < 14.8.5)

OR cpe:/a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* (Version >= 14.8.0 and < 14.8.5)

OR cpe:/a:gitlab:gitlab:*:*:*:*:community:*:*:* (Version >= 14.9.0 and < 14.9.2)

OR cpe:/a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* (Version >= 14.9.0 and < 14.9.2)

Configuration CCN 1:

cpe:/a:gitlab:gitlab:6.2.3:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:6.2.0:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:6.6.0:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:6.6.1:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:9.4.3::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:9.3.9::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:9.2.9::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:9.1.9::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:9.0.12::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:8.17.7::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.1.6:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:10.1.5::~~community~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.1.5::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.2.5::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.2.5::~~community~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.3.3::~~community~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.3.3::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:9.5.10::~~community~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:9.5.10::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.7.1::~~community~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.6.4:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:10.5.7:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:10.7.1::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.6.4:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:10.5.7:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:10.7.5::~~community~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.7.5::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.8.4::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:10.8.4::~~community~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:11.0.0::~~community~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:11.0.0::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:gitlab:gitlab:11.7:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:11.4.13:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:11.5.6:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:11.6.3:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:11.4.13:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:11.5.6:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:11.6.3:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:12.1.1:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:11.11.5:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:11.11.5:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:12.1.1:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:12.0.3:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:12.0.3:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:11.11.7:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:11.11.7:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:12.0.4:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:12.0.4:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:12.1.2:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:12.1.2:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:12.9.2:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:12.9.2:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:13.0.1:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:13.0.1:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:12.6.6:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:12.6.6:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:13.10.3:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:9.5:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:14.7.6:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:14.7.6:*:*:*:enterprise:*:*:*

OR cpe:/a:gitlab:gitlab:14.8.4:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:14.9.1:*:*:*:community:*:*:*

OR cpe:/a:gitlab:gitlab:14.9.1:*:*:*:enterprise:*:*:*

Denotes that component is vulnerable