CVE-2022-1162: Gitlab flaw allows remote attackers to take over user accounts
“A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts. This is a critical severity issue” the company said in an advisory. “We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.”
Affected version
- Gitlab CE/EE 14.7 prior to 14.7.7
- Gitlab CE/EE 14.8 prior to 14.8.5
- Gitlab CE/EE 14.9 prior to 14.9.2
Unaffected version
- Gitlab CE/EE 14.7.7
- Gitlab CE/EE 14.8.5
- Gitlab CE/EE 14.9.2
Solution
At present, GitLab has fixed the CVE-2022-1162 vulnerability in the latest version, please upgrade GitLab to the unaffected version as soon as possible. “We executed a reset of GitLab.com passwords for a selected set of users as of 15:38 UTC. Our investigation shows no indication that users or accounts have been compromised but we’re taking precautionary measures for our users’ security.” continues the advisory.
