CVE-2022-3288
Assigner: GitLab
Published: 2022-10-17T00:00:00
State: PUBLISHED
descriptions: value: A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.
affected: vendor: GitLab
product: GitLab
versions: version: <15.2.5
status: affected
version: >=15.3, <15.3.4
status: affected
version: >=15.4, <15.4.1
status: affected
credits: value: Thanks [st4nly0n](https://hackerone.com/st4nly0n) for reporting this vulnerability through our HackerOne bug bounty program
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
problemTypes: descriptions: type: text
description: Use of incorrectly-resolved name or reference in GitLab