An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the value of an unprotected variable they know the name of in public projects or private projects they're a member of.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2229.json | Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/355738 | Broken Link |
| https://hackerone.com/reports/1511133 | Permissions Required Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
13 Jul 2022, 18:44
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gitlab:gitlab:15.1.0:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:15.1.0:*:*:*:enterprise:*:*:* |
|
| CWE | CWE-863 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| First Time |
Gitlab
Gitlab gitlab |
|
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/355738 - Broken Link | |
| References | (CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2229.json - Vendor Advisory | |
| References | (MISC) https://hackerone.com/reports/1511133 - Permissions Required, Third Party Advisory |
01 Jul 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-01 17:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-2229
Mitre link : CVE-2022-2229
CVE.ORG link : CVE-2022-2229
JSON object : View
Products Affected
gitlab
- gitlab
CWE