NetSight
IP …
critical9.1Public exploit code

CVE-2022-1162

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts

Affected products

VendorProductAffected versions
GitlabGitlab
from 14.7.0 before 14.7.7
from 14.8.0 before 14.8.5
from 14.9.0 before 14.9.2

Weakness classification

CWE-798

References