GitLab has published the next series of corrective updates to its collaborative development platform - 15.3.2, 15.2.4 and 15.1.6, which fixes a critical vulnerability (CVE-2022-2992) that allows an authenticated user to remotely execute code on a server. Like the CVE-2022-2884 vulnerability that was fixed a week ago, a new issue exists in the API for importing data from the GitHub service. The vulnerability manifests itself, among other things, in releases 15.3.1, 15.2.3 and 15.1.5, in which the first vulnerability in the import code from GitHub was fixed.
Operating details have not yet been given. The vulnerability was submitted to GitLab as part of HackerOne's vulnerability bounty program, but unlike the previous issue, it was identified by another contributor. As a workaround, the administrator is advised to disable the import from GitHub feature (in the GitLab web interface: "Menu" -> "Admin" -> "Settings" -> "General" -> "Visibility and access controls" -> "Import sources" -> disable "GitHub").
In addition, 14 more vulnerabilities are fixed in the proposed updates, two of which are marked as dangerous, ten are assigned a medium severity level, and two are marked as non-dangerous. The following are recognized as dangerous: the CVE-2022-2865 vulnerability, which allows you to add your own JavaScript code to pages shown to other users through the manipulation of color labels, as well as the CVE-2022-2527 vulnerability, which makes it possible to substitute your content through the description field in the Incidents scale timeline). Medium severity vulnerabilities are mainly related to the possibility of denial of service.
Source: opennet.ru