Description
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
Exploits (3)
metasploit
WORKING POC
EXCELLENT
by William Bowling (vakzz), Heyder Andrade <https://infosec.exchange/@heyder>, RedWay Security <https://infosec.exchange/@redway> · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb
References (4)
Scores
CVSS v3
9.9
EPSS
0.9371
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lab Environment
Details
CWE
CWE-74
Status
published
Products (1)
gitlab/gitlab
11.10 - 15.1.6 (2 CPE variants)
Published
Oct 17, 2022
Tracked Since
Feb 18, 2026