Intrusion PreventionGitLab.CE.EE.GitHub.Import.CVE-2022-2992.Remote.Code.Execution
Description
This indicates an attack attempt to exploit an Input Validation Error Vulnerability in GitLab GitLab Community Edition (CE) and Enterprise Edition (EE).
The vulnerability is due to due to improper handling of the data returned while running the import. A remote, authenticated attacker can exploit this vulnerability by initiating a GitHub import on a target server to an attacker controlled GitHub server. Successful exploitation could result in the execution of arbitrary commands in the security context of the Redis service on the target server.
Affected Products
GitLab GitLab Community Edition (CE) and Enterprise Edition (EE) 11.10.x through 15.1.6
GitLab GitLab Community Edition (CE) and Enterprise Edition (EE) 15.2.x prior to 15.2.4
GitLab GitLab Community Edition (CE) and Enterprise Edition (EE) 15.3.x prior to 15.3.2
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 52472 |
| Created | Jan 03, 2023 |
| Updated | Jan 18, 2023 |
| Risk |
|
| CVE ID | CVE-2022-2992 |
| Exploit Prediction Score | 4.17% |
| Default Action | drop |
| Active | |
| Affected OS | Linux |
| Affected App | Other |