CVE-2022-4054

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-4054
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4054.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-4054
Aliases
Downstream
Published
2023-01-24T00:00:00Z
Modified
2026-04-10T04:50:46.322379Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4054.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
53f18d8326e26304f6df0996c615ca72b6a85e5b
Fixed
4fc991ae59a1eea8f776ef290e8da400331ba5b9
Database specific 
{
    "versions": [
        {
            "introduced": "9.3"
        },
        {
            "fixed": "15.4.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
af0fced4dd2e767d361f2bdc0732be15ad2c1026
Fixed
5f5109f142d0367fad70ccdb8f7f21e4b5f3c92a
Database specific 
{
    "versions": [
        {
            "introduced": "15.5"
        },
        {
            "fixed": "15.5.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
07a0843ad18ecb422cdc61bf3c2ef0a9dc58a209
Fixed
fe39c71ac74e2a4b9c43fe8a24b07d4dc2b53caa
Database specific 
{
    "versions": [
        {
            "introduced": "15.6"
        },
        {
            "fixed": "15.6.1"
        }
    ]
}

Affected versions

v15.*
v15.5.0-ee
v15.5.1-ee
v15.5.3-ee
v15.5.4-ee
v15.6.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4054.json"