Vulnerability Details : CVE-2022-0123
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
Products affected by CVE-2022-0123
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-0123
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 26 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-0123
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:N/AC:M/Au:S/C:P/I:P/A:N |
6.8
|
4.9
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N |
0.7
|
5.2
|
GitLab Inc. | |
|
6.8
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
1.6
|
5.2
|
NIST |
CWE ids for CVE-2022-0123
-
The product does not validate, or incorrectly validates, a certificate.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-0123
-
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json
2022/CVE-2022-0123.json · master · GitLab.org / cves · GitLabVendor Advisory
Jump to