References https://nvd.nist.gov/vuln/detail/CVE-2022-2992 https://github.com/CsEnox/CVE-2022-2992 https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/ https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json https://access.redhat.com/security/cve/CVE-2022-2992 https://medium.com/@Aacle/%EF%B8%8F-remote-code-execution-in-gitlab-the-tale-of-a-rogue-github-import-660ec866f07c https://www.hkcert.org/security-bulletin/gitlab-remote-code-execution-vulnerability_20220824 https://securityonline.info/cve-2022-2992-gitlab-remote-code-execution-vulnerability/ https://www.secrss.com/articles/46433 https://avd.aliyun.com/detail?id=AVD-2022-2992
Related VulnerabilitiesPoCCVE-2026-85706: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File ReadGitLab CE/EE /api/graphql 未授权访问漏洞(CVE-2026-19478)PoCCVE-2026-19478: GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method InvocationPoCCVE-2021-22175: GitLab CI Lint API - Server-Side Request ForgeryGitLab GitLab CE/EE 权限管理不当漏洞GitLab CE/EE GraphQL 身份验证缺陷漏洞GitLab CE/EE 资源分配控制不当漏洞 可导致拒绝服务gitlab-api-user-enum: GitLab - User Information Disclosure Via Open APIPoCCVE-2024-45409: GitLab - SAML Authentication BypassPoCCVE-2025-25291: GitLab - SAML Authentication BypassPoCCVE-2019-6793: GitLab Enterprise Edition - Server-Side Request ForgeryPoCCVE-2020-2096: Jenkins Gitlab Hook <=1.4.2 - Cross-Site ScriptingPoCCVE-2020-26413: Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure