← Back

CVE-2022-3288

nvd nist
Published: Oct 17, 2022Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
Before 15.2.5
Gitlab
From 15.3 to 15.3.4
Gitlab
From 15.4 to 15.4.1
Gitlab
Before 15.2.5
Gitlab
From 15.3 to 15.3.4
Gitlab
From 15.4 to 15.4.1

Related CWEs

CWE-471
Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.

References (7)

Source: cve@gitlab.com
Vendor Advisory
Source: cve@gitlab.com
Broken LinkVendor Advisory
Source: cve@gitlab.com
Permissions RequiredThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions RequiredThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Broken LinkVendor Advisory

Timeline

No history available yet.