CVE-2022-1148 — Reliance on Cookies without Validation and Integrity Checking in Gitlab

CWE-565 — Reliance on Cookies without Validation and Integrity CheckingCWE-287 — Improper Authentication6 documents5 sources
Severity
6.5MEDIUMNVD
OSV5.0
EPSS
0.2%
top 57.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedApr 4
Latest updateJul 19

Description

Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user's access token on an attacker-controlled private GitLab Pages website and reuse that token on the victim's other private websites

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶NVDgitlab/gitlab11.5.0 — 14.7.7+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=11.5, <14.7.7, >=14.8, <14.8.5, >=14.9, <14.9.2+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

3
OSV
libxmltok vulnerabilities↗2022-07-19
▶
GHSA
GHSA-5fmm-qcg5-xxr7: Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11↗2022-04-05
▶
OSV
CVE-2022-1148: Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11↗2022-04-04
▶

📋Vendor Advisories

2
GitLab
CVE-2022-1148: Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 pri↗2022-04-04
▶
Debian
CVE-2022-1148: gitlab - Improper authorization in GitLab Pages included with GitLab CE/EE affecting all ...↗2022
▶