CVE-2022-1545
published 2022-05-11CVE-2022-1545: It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to…
PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.75%
50.4th percentile
It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 13.2.0 < 14.8.6 | 14.8.6 |
| gitlab | gitlab | >= 14.9.0 < 14.9.4 | 14.9.4 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2022-1545: It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 p
vendor_gitlab·2022-05-11·CVSS 4.3
CVE-2022-1545 [MEDIUM] CVE-2022-1545: It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 p
CVE-2022-1545: It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.
Debian
CVE-2022-1545: gitlab - It was possible to disclose details of confidential notes created via the API in...
vendor_debian·2022·CVSS 4.3
CVE-2022-1545 [MEDIUM] CVE-2022-1545: gitlab - It was possible to disclose details of confidential notes created via the API in...
It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-mc38-g3j7-hgww: It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13
ghsa_unreviewed·2022-05-12
CVE-2022-1545 [MEDIUM] CWE-863 GHSA-mc38-g3j7-hgww: It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13
It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-05-11
Published