CVE-2022-3288

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-3288
A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3288.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/354948 Broken Link Vendor Advisory
https://hackerone.com/reports/1498354 Permissions Required Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3288.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/354948 Broken Link Vendor Advisory
https://hackerone.com/reports/1498354 Permissions Required Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/354948 Broken Link Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
History

13 May 2025, 16:15

Type Values Removed Values Added
References () https://gitlab.com/gitlab-org/gitlab/-/issues/354948 - Broken Link, Vendor Advisory () https://gitlab.com/gitlab-org/gitlab/-/issues/354948 - Broken Link, Vendor Advisory
CWE CWE-471

21 Nov 2024, 07:19

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 3.5
References () https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3288.json - Vendor Advisory () https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3288.json - Vendor Advisory
References () https://gitlab.com/gitlab-org/gitlab/-/issues/354948 - Broken Link, Vendor Advisory () https://gitlab.com/gitlab-org/gitlab/-/issues/354948 - Broken Link, Vendor Advisory
References () https://hackerone.com/reports/1498354 - Permissions Required, Third Party Advisory () https://hackerone.com/reports/1498354 - Permissions Required, Third Party Advisory
Information

Published : 2022-10-17 16:15

Updated : 2025-05-13 16:15

NVD link : CVE-2022-3288

Mitre link : CVE-2022-3288

CVE.ORG link : CVE-2022-3288

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
NVD-CWE-noinfo CWE-471

Modification of Assumed-Immutable Data (MAID)