What is CVE-2022-0123?

CVE-2022-0123 is a medium-severity vulnerability in Gitlab, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2022-03-28.

How severe is CVE-2022-0123?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Gitlab

CVE-2022-0123

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.

Vulnerability class: Improper Certificate Validation

EPSS: 0.004 (35.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N.

Affected products

Gitlab — versions <14.4.5, >=14.5.0, <14.5.3, >=14.6.0, <14.6.1

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

cve@gitlab.com (x_refsource_MISC, Broken Link)
cve@gitlab.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2022-0123?: CVE-2022-0123 is a medium-severity vulnerability in Gitlab, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2022-03-28.
How severe is CVE-2022-0123?: Medium severity. CVSS v3 base score is 5.9 out of 10.