Home
Tech info
Technology
Science
Life
Application
Electric
Program
Mobile
Windows 10
Windows 11GitLab patches critical vulnerability that allows hackers to take control of accounts
This vulnerability was discovered by GitLab employees themselves and is tracked under the code CVE-2022-1162. It affects both GitLab Community Edition (CE) and Enterprise Edition (EE).
CVE-2022-1162 comes from an inadvertently set static password during OmniAuth-based registration in GitLab CE/EE.
"Hard-coded passwords were set for accounts registered with OmniAuth providers (e.g. OAuth, LDAP, SAML) in GitLab CE/EE version 14.7 prior to 14.7.7, 14.8 prior to 14.8.5 and 14.9 before 14.9.2 allowed hackers to take control of the account," the GitLab team shared.
GitLab urges users to immediately upgrade all GitLab installations to the latest version (14.9.2, 14.8.5 or 14.7.7) to prevent the risk of being hacked.
As part of an effort to mitigate the damage of CVE-2022-1162, GitLab said it has reset the passwords of some GitLab.com users. In addition, a recently submitted commit revealed that GitLab removed the file "lib/gitlab/password.rb" that was used to attach a weakly hard-coded password to the row number "TEST_DEFAULT".
GitLab says it has not seen any evidence of user accounts being compromised by hackers by exploiting this vulnerability. Even so, GitLab still creates a script that administrators can use to identify user accounts potentially affected by CVE-2022-1162. Details about the vulnerability and how to download the script can be found here.
Once a potentially affected user account is identified, an administrator should reset the user's password.
More than 100,000 organizations use GitLab's DevOps platform, and an estimated 30 million users from 66 countries are registered with the platform.
Kareem WintersYou should read it
- 'Printer Catastrophe' Vulnerability Threatens All Versions of Windows
- Log4Shell zero-day vulnerability discovered, the new nightmare of enterprises
- Apple releases iOS 14.4.2, iOS 12.5.2, and watchOS 7.3.3 updates that patch the critical zero-day vulnerability
- New privilege escalation vulnerability called 'Dirty Pipe' is threatening all Linux distros
- The NSA issued an urgent warning about a critical vulnerability appearing in Windows servers
- Google has just patched a critical Gmail vulnerability, allowing hackers to send fake emails
- Patches of dangerous vulnerabilities being exploited by hackers contain dangerous holes and then continue to be exploited by hackers
- Critical Vulnerability Discovered in 3 WordPress Plugins, Affects 84,000 Websites
May be interested
- Log4Shell zero-day vulnerability discovered, the new nightmare of enterprises
how to exploit a critical zero-day vulnerability in the java-based apache log4j logging library has just been posted on the internet. this leaves users and businesses as well as organizations vulnerable to remote code execution attacks. - Hacker took advantage of the vulnerability in SS7 to steal bank accountsthe ss7 telecommunications vulnerability is no stranger when it not only has the ability to control applications but also steal your bank account information.
- Google discovered a dangerous zero day vulnerability on many Samsung Galaxy, Huawei, Xiaomi and even Pixel phonesthis vulnerability affects many major phone companies including huawei p20, pixel 1 and pixel 2, xiaomi, samsung with galaxy s7, s8 and s9 ... and most likely exploited by hackers.
- Many serious security holes are found in GitLabin the last week, gitlab has released a variety of unusual updates to thoroughly address some of the key security holes found on the platform.
- Firefox releases urgent update to patch zero-day vulnerability being exploited by hackersmozilla has just released urgent updates for firefox 97.0.2, firefox esr 91.6.1, firefox for android 97.3.0 and focus 97.3.0 to fix two critical zero-day vulnerabilities being exploited by hackers.
- The NSA issued an urgent warning about a critical vulnerability appearing in Windows serversthis is a vulnerability that exists in the cryptographic authentication scheme used by the netlogon remote protocol.
- The new zero-day vulnerability on Windows 10 helps hackers take control of the computerthis is a serious security vulnerability that could allow hackers to attack and gain control of computer devices.
- Detecting a new Linux vulnerability allows hackers to gain control of the VPN connectioninternational security researchers have found an entirely new linux vulnerability that allows potential attackers to hijack vpn connections on the device * nix and 'inject' the arbitrary data payload into it. tcp4 and ipv6 streams.
- New privilege escalation vulnerability called 'Dirty Pipe' is threatening all Linux distrosrecently, security researcher max kellermann shared about a security flaw called 'dirty pipe'. it affects linux kernel 5.8 and above and even android devices.
- Detected critical zero-day vulnerability on Adobe Readeradobe has just released the may security update to patch security holes in 12 of their products. among them is a serious zero-day vulnerability in adobe reader that is being actively exploited by hackers.
Attack the network
- New phishing toolkit discovered that makes it easy to create fake Chrome browser windows
- Specter V2 vulnerability re-appears to attack Intel, Arm CPUs, AMD chips are not affected
- Notorious botnet TrickBot stopped working, redirected to another form of malicious code that could be more dangerous
- NVIDIA suffered a cyber attack, massive damage estimated
- Ransomware is being used as bait in data destruction attacks targeting Ukraine
- Detecting botnets that can easily bypass Windows Defender and steal crypto wallet data
New phishing toolkit discovered that makes it easy to create fake Chrome browser windows
Specter V2 vulnerability re-appears to attack Intel, Arm CPUs, AMD chips are not affected
Notorious botnet TrickBot stopped working, redirected to another form of malicious code that could be more dangerous
NVIDIA suffered a cyber attack, massive damage estimated
Ransomware is being used as bait in data destruction attacks targeting Ukraine
Detecting botnets that can easily bypass Windows Defender and steal crypto wallet data