{"api_version":"1","generated_at":"2026-04-23T18:05:59+00:00","cve":"CVE-2022-2884","urls":{"html":"https://cve.report/CVE-2022-2884","api":"https://cve.report/api/cve/CVE-2022-2884.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-2884","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-2884"},"summary":{"title":"CVE-2022-2884","description":"A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint","state":"PUBLIC","assigner":"cve@gitlab.com","published_at":"2022-10-17 16:15:00","updated_at":"2023-04-03 20:15:00"},"problem_types":["CWE-78"],"metrics":[],"references":[{"url":"http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html","name":"http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html","refsource":"MISC","tags":[],"title":"GitLab 15.3 Remote Code Execution ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://hackerone.com/reports/1672388","name":"https://hackerone.com/reports/1672388","refsource":"MISC","tags":[],"title":"HackerOne","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json","name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json","refsource":"CONFIRM","tags":[],"title":"2022/CVE-2022-2884.json · master · GitLab.org / cves · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/371098","name":"https://gitlab.com/gitlab-org/gitlab/-/issues/371098","refsource":"MISC","tags":[],"title":"RCE via github import (#371098) · Issues · GitLab.org / GitLab · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2884","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2884","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program.","lang":""}],"nvd_cpes":[{"cve_year":"2022","cve_id":"2884","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"2884","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-2884","qid":"376864","title":"GitLab Remote Command Execution Vulnerability"},{"cve":"CVE-2022-2884","qid":"690925","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for gitlab (8a0cd618-22a0-11ed-b1e7-001b217b3468)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2022-2884","ASSIGNER":"cve@gitlab.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"GitLab","product":{"product_data":[{"product_name":"GitLab","version":{"version_data":[{"version_value":">=11.3.4, <15.1.5"},{"version_value":">=15.2, <15.2.3"},{"version_value":">=15.3, <15.3.1"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper neutralization of special elements used in an os command ('os command injection') in GitLab"}]}]},"references":{"reference_data":[{"name":"https://gitlab.com/gitlab-org/gitlab/-/issues/371098","url":"https://gitlab.com/gitlab-org/gitlab/-/issues/371098","refsource":"MISC"},{"name":"https://hackerone.com/reports/1672388","url":"https://hackerone.com/reports/1672388","refsource":"MISC"},{"name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json","url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json","refsource":"CONFIRM"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html","url":"http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html"}]},"description":{"description_data":[{"lang":"eng","value":"A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint"}]},"impact":{"cvss":{"vectorString":"AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL"}},"credit":[{"lang":"eng","value":"Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program."}]},"nvd":{"publishedDate":"2022-10-17 16:15:00","lastModifiedDate":"2023-04-03 20:15:00","problem_types":["CWE-78"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.1,"impactScore":6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"15.3","versionEndExcluding":"15.3.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"11.3.4","versionEndExcluding":"15.1.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"11.3.4","versionEndExcluding":"15.1.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"15.2","versionEndExcluding":"15.2.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"15.2","versionEndExcluding":"15.2.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"15.3","versionEndExcluding":"15.3.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}