CVE-2022-3060

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-17 · updated 2026-06-17
Weakness: CWE-22

Description

Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests

Affected products

GitLab: through 12.7.0

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3060.json
https://gitlab.com/gitlab-org/gitlab/-/issues/365427
https://hackerone.com/reports/1600343
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3060.json
https://gitlab.com/gitlab-org/gitlab/-/issues/365427
https://hackerone.com/reports/1600343

Get alerted when CVE-2022-3060 or the next vulnerability affects your stack