{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","cveId":"CVE-2022-3902","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","assignerShortName":"GitLab","dateUpdated":"2025-04-02T15:00:25.550Z","dateReserved":"2022-11-08T00:00:00.000Z","datePublished":"2023-01-24T00:00:00.000Z"},"containers":{"cna":{"providerMetadata":{"orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","shortName":"GitLab","dateUpdated":"2023-01-24T00:00:00.000Z"},"descriptions":[{"lang":"en","value":"An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks."}],"affected":[{"vendor":"GitLab","product":"GitLab","versions":[{"version":">=9.3, <15.4.6","status":"affected"},{"version":">=15.5, <15.5.5","status":"affected"},{"version":">=15.6, <15.6.1","status":"affected"}]}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/381895"},{"url":"https://hackerone.com/reports/1757999"},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json"}],"credits":[{"lang":"en","value":"Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"Information exposure in GitLab"}]}]},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T01:20:59.008Z"},"title":"CVE Program Container","references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/381895","tags":["x_transferred"]},{"url":"https://hackerone.com/reports/1757999","tags":["x_transferred"]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json","tags":["x_transferred"]}]},{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-532","lang":"en","description":"CWE-532 Insertion of Sensitive Information into Log File"}]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-02T15:00:00.816401Z","id":"CVE-2022-3902","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-04-02T15:00:25.550Z"}}]}}