CVE Vulnerabilities

CVE-2022-2229

Published: Jul 01, 2022 | Modified: Aug 08, 2023
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
LOW

An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the value of an unprotected variable they know the name of in public projects or private projects theyre a member of.

Affected Software

Name Vendor Start Version End Version
Gitlab Gitlab 13.7.0 (including) 14.10.5 (excluding)
Gitlab Gitlab 15.0.0 (including) 15.0.4 (excluding)
Gitlab Gitlab 15.1.0 (including) 15.1.0 (including)
Gitlab Ubuntu esm-apps/xenial *

References