{"id":104974,"date":"2022-08-31T09:36:39","date_gmt":"2022-08-31T07:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab"},"modified":"2022-08-31T09:36:39","modified_gmt":"2022-08-31T07:36:39","slug":"vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","title":{"rendered":"The second critical vulnerability in GitLab this week.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitLab has released another series of corrective updates for its collaborative development platform \u2014 15.3.2, 15.2.4, and 15.1.6, addressing a critical vulnerability (CVE-2022-2992) that allows an authenticated user to execute code remotely on the server. Similar to the CVE-2022-2884 vulnerability fixed last week, the new issue exists in the API for importing data from GitHub. The vulnerability also affects versions 15.3.1, 15.2.3, and 15.1.5, which contained a fix for the initial GitHub import code vulnerability. <\/p>\n
Details regarding the exploitation of the vulnerability have not yet been provided. The information about the vulnerability was reported to GitLab as part of the ongoing HackerOne bounty program for reporting vulnerabilities, but unlike the previous issue, it was discovered by a different participant. As a workaround, administrators are advised to disable the GitHub import feature (in the GitLab web interface: \u201cMenu\u201d -> \u201cAdmin\u201d -> \u201cSettings\u201d -> \u201cGeneral\u201d -> \u201cVisibility and access controls\u201d -> \u201cImport sources\u201d -> disable \u201cGitHub\u201d). <\/p>\n
Additionally, the proposed updates fix another 14 vulnerabilities, two of which are categorized as critical, ten assigned a medium danger rating, and two marked as low risk. The critical vulnerabilities include: CVE-2022-2865, which allows an attacker to inject their JavaScript code into pages viewed by other users through manipulation of colored labels, and CVE-2022-2527, which enables content injection via the description field in the Incidents Timeline. Medium-risk vulnerabilities are primarily related to the potential for denial of service attacks. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"