CVE-2022-0172
published 2022-01-18CVE-2022-0172: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.77%
50.9th percentile
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 13.2 < 14.4.5 | 14.4.5 |
| gitlab | gitlab | >= 14.5.0 < 14.5.3 | 14.5.3 |
| gitlab | gitlab | >= 14.6.0 < 14.6.2 | 14.6.2 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv6.5MEDIUM
cisa8.6HIGH
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jm36-4mv9-x2pw: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12
ghsa_unreviewed·2022-01-19
CVE-2022-0172 [MEDIUM] CWE-863 GHSA-jm36-4mv9-x2pw: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.
OSV
CVE-2022-0172: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12
osv·2022-01-18·CVSS 6.5
CVE-2022-0172 [MEDIUM] CVE-2022-0172: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.
CISA
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
cisa·2022-03-03·CVSS 8.6
CVE-2018-0172 [HIGH] CWE-20 Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Vulnerability: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Affected: Cisco IOS and IOS XE Software
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-0172
Remediation Due Date: 2022-03-17
GitLab
CVE-2022-0172: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP rest
vendor_gitlab·2022-01-18·CVSS 5.3
CVE-2022-0172 [MEDIUM] CVE-2022-0172: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP rest
CVE-2022-0172: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.
Debian
CVE-2022-0172: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting wit...
vendor_debian·2022·CVSS 5.3
CVE-2022-0172 [MEDIUM] CVE-2022-0172: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting wit...
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-01-18
Published