{"api_version":"1","generated_at":"2026-07-23T22:43:25+00:00","cve":"CVE-2022-0154","urls":{"html":"https://cve.report/CVE-2022-0154","api":"https://cve.report/api/cve/CVE-2022-0154.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-0154","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-0154"},"summary":{"title":"CVE-2022-0154","description":"An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.","state":"PUBLIC","assigner":"cve@gitlab.com","published_at":"2022-01-18 17:15:00","updated_at":"2022-01-26 16:15:00"},"problem_types":["CWE-352"],"metrics":[],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/29580","name":"https://gitlab.com/gitlab-org/gitlab/-/issues/29580","refsource":"MISC","tags":[],"title":"Not Found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json","name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json","refsource":"CONFIRM","tags":[],"title":"2022/CVE-2022-0154.json · master · GitLab.org / cves · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://hackerone.com/reports/605576","name":"https://hackerone.com/reports/605576","refsource":"MISC","tags":[],"title":"HackerOne","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0154","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0154","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Thanks @aryan2808 for reporting this vulnerability through our HackerOne bug bounty program","lang":""}],"nvd_cpes":[{"cve_year":"2022","cve_id":"154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-0154","qid":"379226","title":"GitLab Multiple Security Vulnerabilities (gitlab- 14.6.2, 14.5.3, 14.4.5)"},{"cve":"CVE-2022-0154","qid":"690770","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for gitlab (43f84437-73ab-11ec-a587-001b217b3468)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2022-0154","ASSIGNER":"cve@gitlab.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"GitLab","product":{"product_data":[{"product_name":"GitLab","version":{"version_data":[{"version_value":">=7.7, <14.4.5"},{"version_value":">=14.5.0, <14.5.3"},{"version_value":">=14.6.0, <14.6.2"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-site request forgery (csrf) in GitLab"}]}]},"references":{"reference_data":[{"name":"https://gitlab.com/gitlab-org/gitlab/-/issues/29580","url":"https://gitlab.com/gitlab-org/gitlab/-/issues/29580","refsource":"MISC"},{"name":"https://hackerone.com/reports/605576","url":"https://hackerone.com/reports/605576","refsource":"MISC"},{"name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json","url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json","refsource":"CONFIRM"}]},"description":{"description_data":[{"lang":"eng","value":"An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account."}]},"impact":{"cvss":{"vectorString":"AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","version":"3.1","baseScore":7.5,"baseSeverity":"HIGH"}},"credit":[{"lang":"eng","value":"Thanks @aryan2808 for reporting this vulnerability through our HackerOne bug bounty program"}]},"nvd":{"publishedDate":"2022-01-18 17:15:00","lastModifiedDate":"2022-01-26 16:15:00","problem_types":["CWE-352"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6},"severity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"14.5.0","versionEndExcluding":"14.5.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"14.5.0","versionEndExcluding":"14.5.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"14.6.0","versionEndExcluding":"14.6.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"14.6.0","versionEndExcluding":"14.6.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"7.7","versionEndExcluding":"14.4.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"7.7","versionEndExcluding":"14.4.5","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"154","Ordinal":"225259","Title":"CVE-2022-0154","CVE":"CVE-2022-0154","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"154","Ordinal":"1","NoteData":"An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.","Type":"Description","Title":null},{"CveYear":"2022","CveId":"154","Ordinal":"2","NoteData":"2022-01-18","Type":"Other","Title":"Published"},{"CveYear":"2022","CveId":"154","Ordinal":"3","NoteData":"2022-01-18","Type":"Other","Title":"Modified"}]}}}