CVE-2022-3288 — Vulnetix

CVE-2022-3288 PUBLISHED

A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.

EPSS 0.12% · 29.8th percentile

Risk Scores

EPSS Score

0.12%

29.8th percentile

Affected Products

Vendor	Product	Versions
Bitnami	gitlab	15.3.0, 15.4.0, 0
Bitnami	gitlab	0, 15.3.0, 15.4.0

Exploit Intelligence

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3288.json (circl)
https://gitlab.com/gitlab-org/gitlab/-/issues/354948 (cve.org)
https://hackerone.com/reports/1498354 (bitnami)

Timeline

Jul 1, 2022 CVE Published
Oct 18, 2022 EPSS Score
Dec 1, 2022 EPSS Score
Jan 14, 2023 EPSS Score
Feb 26, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 11, 2023 EPSS Score
May 25, 2023 EPSS Score
Jul 8, 2023 EPSS Score
Aug 21, 2023 EPSS Score
Oct 3, 2023 EPSS Score
Nov 16, 2023 EPSS Score

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3288.json url
https://gitlab.com/gitlab-org/gitlab/-/issues/354948 url
https://hackerone.com/reports/1498354 url
https://nvd.nist.gov/vuln/detail/CVE-2022-3288 url

Open in Interactive Console →