Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-zmhb-purs-aqa1
SummaryA vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
Aliases
0
alias CVE-2022-2992
Fixed_packages
0
url pkg:deb/debian/gitlab@15.10.8%2Bds1-2?distro=sid
purl pkg:deb/debian/gitlab@15.10.8%2Bds1-2?distro=sid
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/gitlab@15.10.8%252Bds1-2%3Fdistro=sid
1
url pkg:deb/debian/gitlab@17.6.5-19?distro=sid
purl pkg:deb/debian/gitlab@17.6.5-19?distro=sid
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/gitlab@17.6.5-19%3Fdistro=sid
Affected_packages
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-2992
reference_id
reference_type
scores
0
value 0.93693
scoring_system epss
scoring_elements 0.99846
published_at 2026-04-02T12:55:00Z
1
value 0.93693
scoring_system epss
scoring_elements 0.99848
published_at 2026-04-11T12:55:00Z
2
value 0.93693
scoring_system epss
scoring_elements 0.99847
published_at 2026-04-07T12:55:00Z
3
value 0.93712
scoring_system epss
scoring_elements 0.99851
published_at 2026-04-24T12:55:00Z
4
value 0.93712
scoring_system epss
scoring_elements 0.9985
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-2992
1
reference_url https://hackerone.com/reports/1679624
reference_id 1679624
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-05-14T14:27:07Z/
url https://hackerone.com/reports/1679624
2
reference_url https://gitlab.com/gitlab-org/gitlab/-/issues/371884
reference_id 371884
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-05-14T14:27:07Z/
url https://gitlab.com/gitlab-org/gitlab/-/issues/371884
3
reference_url https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json
reference_id CVE-2022-2992.json
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-05-14T14:27:07Z/
url https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json
4
reference_url http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html
reference_id GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-05-14T14:27:07Z/
url http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html
Weaknesses
Exploits
0
date_added null
description 
An authenticated user can import a repository from GitHub into GitLab.
          If a user attempts to import a repo from an attacker-controlled server,
          the server will reply with a Redis serialization protocol object in the nested
          `default_branch`. GitLab will cache this object and
          then deserialize it when trying to load a user session, resulting in RCE.
required_action null
due_date null
notes 
Stability:
  - crash-safe
Reliability:
  - repeatable-session
SideEffects:
  - ioc-in-logs
known_ransomware_campaign_use false
source_date_published 2022-10-06
exploit_type null
platform Unix
source_date_updated null
data_source Metasploit
source_url https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb
Severity_range_score9.9 - 9.9
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-zmhb-purs-aqa1