CVE-2022-3793

Published: Nov 10, 2022Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 12.6.0 to 15.3.5
Gitlab Gitlab	From 15.4.0 to 15.4.4
Gitlab Gitlab	From 15.5.0 to 15.5.2
Gitlab Gitlab	From 12.6.0 to 15.3.5
Gitlab Gitlab	From 15.4.0 to 15.4.4
Gitlab Gitlab	From 15.5.0 to 15.5.2

References (4)

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3793.json

Source: cve@gitlab.com

Vendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/372120

Source: cve@gitlab.com

Broken LinkVendor Advisory

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3793.json

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/372120

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

Timeline

No history available yet.