Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-1162
Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
GitLab Community Edition和GitLab Enterprise Edition 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GitLab Enterprise Edition是一套内容管理系统。GitLab Community Edition是美国GitLab公司的一种社区版 GitLab 。 GitLab Community Edition (CE) and Enterprise Edition (EE)存在信任管理问题漏洞,该漏洞由于基于 OmniAuth 的注册中的应用程序代码中存在硬编码凭据,因此存在该漏洞。未经身份验证的远程攻击者可以使用硬编码凭据访问受影响的系统。该漏洞允许远程攻击者获得对易受攻击系统的完全访问权限
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
GitLabGitLab >=14.9, <14.9.2 -
II. Public POCs for CVE-2022-1162
#POC DescriptionSource LinkShenlong Link
1Nonehttps://github.com/Greenwolf/CVE-2022-1162POC Details
2A simple tool to enumerate users in gitlabhttps://github.com/ipsBruno/CVE-2022-1162POC Details
3GitLab CE/EE contains a hard-coded credentials vulnerability. A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML), allowing attackers to potentially take over accounts. This template attempts to passively identify vulnerable versions of GitLab without the need for an exploit by matching unique hashes for the application-<hash>.css file in the header for unauthenticated requests. Positive matches do not guarantee exploitability. Affected versions are 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2.https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1162.yamlPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2022-1162
Please Login to view more intelligence information
IV. Related Vulnerabilities
V. Comments for CVE-2022-1162

No comments yet


Leave a comment