Information disclosure in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2022-4054
Published: December 1, 2022
Vulnerability identifier: #VU69776
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-4054
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote administrator can leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.
Affected software
Gitlab Community Edition
GitLab Enterprise Edition
GitLab Enterprise Edition
How to mitigate CVE-2022-4054
Install updates from vendor's website.
Gitlab Community Edition - addressed in versions 15.4.6, 15.5.5, 15.6.1
GitLab Enterprise Edition - addressed in versions 15.4.6, 15.5.5, 15.6.1
GitLab Enterprise Edition - addressed in versions 15.4.6, 15.5.5, 15.6.1