An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all     versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious     Maintainer can leak masked webhook secrets by changing target URL of the webhook. (CVE-2022-4342)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of GitLab installed on the remote host is prior to 15.5.7, 15.6.4, 15.7.2. It is, therefore, affected by an information disclosure vulnerability as referenced in the SECURITY-RELEASE-GITLAB-15-7-2-RELEASED advisory.

  - An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all     versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious     Maintainer can leak masked webhook secrets by changing target URL of the webhook. (CVE-2022-4342)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3a023570-91ab-11ed-8950-001b217b3468 advisory.

  - Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior     to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group     owner loses the ability to revoke them. (CVE-2022-4167)

  - An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all     versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may     cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.
    (CVE-2022-3514)

  - An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all     versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the     improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary     JavaScript on the self-hosted instances running without strict CSP. (CVE-2022-3573)

  - An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting     from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query     can cause high resource consumption and may lead to Denial of Service. (CVE-2022-3613)

  - An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all     versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows     unauthenticated users to download user avatars using the victim's user ID, on private instances that     restrict public level visibility. (CVE-2022-3870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
187499	GitLab 15.1 < 15.5.7 / 15.6 < 15.6.4 / 15.7 < 15.7.2 (CVE-2022-4342)	Nessus	CGI abuses	low
171156	GitLab < 15.5.7 / 15.6 < 15.6.4 / 15.7 < 15.7.2 (CVE-2022-4342)	Nessus	CGI abuses	low
169892	FreeBSD : Gitlab -- Multiple Vulnerabilities (3a023570-91ab-11ed-8950-001b217b3468)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2022-4342

low

Tenable Plugins

low

low

high