CVE-2022-2884

CRITICAL

GitLab CE/EE <15.1.5-15.3.1 - Authenticated RCE

Title source: llm

Description

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

Exploits (2)

exploitdb WORKING POC VERIFIED
by Antonio Francesco Sardella · pythonwebappsruby
https://www.exploit-db.com/exploits/51181
nomisec WORKING POC 27 stars
by m3ssap0 · poc
https://github.com/m3ssap0/gitlab_rce_cve-2022-2884

Scores

CVSS v3 9.9
EPSS 0.6774
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
gitlab/gitlab 11.3.4 - 15.1.5 (2 CPE variants)
Published Oct 17, 2022
Tracked Since Feb 18, 2026