CVE-2022-1352

Published: May 11, 2022Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 11.0.0 to 14.8.6
Gitlab Gitlab	From 14.9.0 to 14.9.4
Gitlab Gitlab	From 11.0.0 to 14.8.6
Gitlab Gitlab	From 14.9.0 to 14.9.4
Gitlab Gitlab	Version 14.10.0
Gitlab Gitlab	Version 14.10.0