BIT-gitlab-2022-1162

vendorUSosv

view advisory published 2024-03-06Licence: per source

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-1162US	critical9.8OT high	75.6% (100th)	Exploit	2022-04-04
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14…

references

External citations — patches, advisories, analysis.

http://packetstormsecurity.com/files/166828/Gitlab-14.9-Authentication-Bypass.htmlADVISORY
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1162.jsonADVISORY
https://gitlab.com/gitlab-org/gitlab/-/issues/357210WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-1162WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan