CVE-2022-1162

CRITICAL NUCLEI

Gitlab < 14.7.7 - Hard-coded Credentials

Title source: rule

Description

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts

Exploits (4)

exploitdb WORKING POC
by Greenwolf · textwebappsruby
https://www.exploit-db.com/exploits/50888
nomisec WRITEUP 4 stars
by Greenwolf · poc
https://github.com/Greenwolf/CVE-2022-1162
nomisec WORKING POC 3 stars
by ipsBruno · poc
https://github.com/ipsBruno/CVE-2022-1162

Nuclei Templates (1)

GitLab CE/EE - Hard-Coded Credentials
CRITICALby GitLab Red Team
Shodan: http.title:"GitLab" || cpe:"cpe:2.3:a:gitlab:gitlab" || http.title:"gitlab"
FOFA: title="gitlab"

References (3)

Scores

CVSS v3 9.1
EPSS 0.8761
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-798
Status published
Products (1)
gitlab/gitlab 14.7.0 - 14.7.7 (2 CPE variants)
Published Apr 04, 2022
Tracked Since Feb 18, 2026