CVE-2022-4054
Assigner: GitLab
Published: 2023-01-24T00:00:00
State: PUBLISHED
descriptions: value: An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.
affected: vendor: GitLab
product: GitLab
versions: version: >=9.3, <15.4.6
status: affected
version: >=15.5, <15.5.5
status: affected
version: >=15.6, <15.6.1
status: affected
credits: value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program.
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
problemTypes: descriptions: type: text
description: Information exposure in GitLab