CVE-2022-1936

Published: Jun 6, 2022Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured

Affected (3)

Products: Gitlab: Gitlab

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 12.0.0 to 14.9.5
Gitlab Gitlab	From 14.10.0 to 14.10.4
Gitlab Gitlab	Version 15.0.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1936.json

Source: cve@gitlab.com

PatchThird Party Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/363638

Source: cve@gitlab.com

Broken Link

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1936.json

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/363638

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.