CVE-2022-2185

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-2185
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-2185.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-2185
Aliases
Published
2022-07-01T15:50:03Z
Modified
2025-11-28T02:34:15.784400Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2185.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
0034acfc891b0cbc2ecc4aa4c5ca0d1f89e3c32f
Fixed
af6735ad95ff7a4578c8548d37ce9e8247385d5e
Database specific 
{
    "versions": [
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.10.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
3b397c1753233301037d0ca3caae23ce116505d3
Fixed
81f47cb467e3387cea11b909ea6b977e28b3b4d2
Database specific 
{
    "versions": [
        {
            "introduced": "15.0"
        },
        {
            "fixed": "15.0.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
31c24d2d8643ee22211ef544a4538c4420e96dc9
Fixed
61c8658b23e2cc1116acb740418d99c6d227e13f
Database specific 
{
    "versions": [
        {
            "introduced": "15.1"
        },
        {
            "fixed": "15.1.1"
        }
    ]
}

Affected versions

v15.*

v15.0.0-ee
v15.0.1-ee
v15.0.2-ee
v15.0.3-ee
v15.1.0-ee

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-2185.json"