TI-2022-03846 Aliases CVE-2022-4201 GHSA-9ppv-xcv2-vhqr

Server-side request forgery in GitLab

MEDIUM 57CWE-918Published 2023-01-27 · Updated 2025-03-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00552 46th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed GitLab (GitLab): 15.4.6, 15.5.5, 15.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GitLab	GitLab	11.3 to before 15.4.6; 15.5 to before 15.5.5; 15.6 to before 15.6.1	15.4.6, 15.5.5, 15.6.1	Patch available	CNA

GitLab VendorGitLab Affected 11.3 to before 15.4.6; 15.5 to before 15.5.5; 15.6 to before 15.6.1 Fixed in 15.4.6, 15.5.5, 15.6.1 Patch available CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:gitlab:gitlab:::::community:::*	11.3.0 to before 15.4.6	Vulnerable	GitLab
cpe:2.3:a:gitlab:gitlab:::::enterprise:::*	11.3.0 to before 15.4.6	Vulnerable	GitLab
cpe:2.3:a:gitlab:gitlab:::::community:::*	15.5.0 to before 15.5.5	Vulnerable	GitLab
cpe:2.3:a:gitlab:gitlab:::::enterprise:::*	15.5.0 to before 15.5.5	Vulnerable	GitLab
cpe:2.3:a:gitlab:gitlab:15.6.0::::community:::	15.6.0	Vulnerable	GitLab
cpe:2.3:a:gitlab:gitlab:15.6.0::::enterprise:::	15.6.0	Vulnerable	GitLab

cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* Versions 11.3.0 to before 15.4.6 Vulnerable ·GitLab
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* Versions 11.3.0 to before 15.4.6 Vulnerable ·GitLab
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* Versions 15.5.0 to before 15.5.5 Vulnerable ·GitLab
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* Versions 15.5.0 to before 15.5.5 Vulnerable ·GitLab
cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:* Versions 15.6.0 Vulnerable ·GitLab
cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:* Versions 15.6.0 Vulnerable ·GitLab

Remediation

Fix · CNA GitLab (GitLab) Fixed in 15.4.6, 15.5.5, 15.6.1

Timeline

2026-10-02 Threatist record created from CVE-2022-4201
2026-10-03 Alias added: GHSA-9ppv-xcv2-vhqr

References

Exploit 1

https://gitlab.com/gitlab-org/gitlab/-/issues/30376

Advisory 1

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4201.json

TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
TI-2026-58817 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab KEVCVSS 3.1CRITICAL 10.0
TI-2023-06425 Weak Password Recovery Mechanism for Forgotten Password in GitLab KEVCVSS 3.1CRITICAL 10.0
TI-2021-05191 Code injection in GitLab KEVCVSS 3.1CRITICAL 10.0
TI-2021-05161 Server-side request forgery in GitLab KEVCVSS 3.1CRITICAL 9.8
TI-2022-02763 Injection in GitLab CVSS 3.1CRITICAL 9.9

See all 1506 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences