HomePentest-Tools.com Logo

GitLab CE/EE - Hard-Coded Credentials CVE-2022-1162

Severity
CVSSv3 Score
9.8
Vulnerability description

GitLab CE/EE contains a hard-coded credentials vulnerability. A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML), allowing attackers to potentially take over accounts. This template attempts to passively identify vulnerable versions of GitLab without the need for an exploit by matching unique hashes for the application-.css file in the header for unauthenticated requests. Positive matches do not guarantee exploitability. Affected versions are 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2.

Risk description

No risk description to display.

Recommendation

Tooling to find relevant hashes based on the semantic version ranges specified in the CVE is linked in the reference section below.

Codename
Not available
Detectable with
Network Scanner
Scan engine
Nuclei
Exploitable with Sniper
No
CVE Published
Apr 4, 2022
Detection added at
Software Type
Not available
Vendor
Not available
Product
Not available