{"id":"CVE-2022-31267","details":"Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\\n\\trole = \"#admin\"' value.","aliases":["GHSA-fh55-vwjc-69c7"],"modified":"2026-09-14T11:45:11.660848741Z","published":"2022-05-21T20:35:31Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31267.json"},"references":[{"type":"WEB","url":"https://github.com/gitblit/gitblit/releases/tag/v1.9.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31267.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31267"},{"type":"REPORT","url":"https://github.com/gitblit/gitblit/issues/1410"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gitblit-org/gitblit","events":[{"introduced":"a69867ce56bc40c248ffea75f7a6e7b053d6beb7"},{"fixed":"c5e49ef3ee60b28c3f1db0a41e37da50efc41033"}],"database_specific":{"extracted_events":[{"introduced":"1.9.2"},{"last_affected":"1.9.2"}],"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:gitblit:gitblit:1.9.2:*:*:*:*:*:*:*"}}],"versions":["1.9.2","v1.9.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31267.json"}}],"schema_version":"1.9.0"}