CVE-2022-1944
published 2022-06-06CVE-2022-1944: When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10…
PriorityP338high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
EPSS
0.52%
40.4th percentile
When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 11.3.0 < 14.9.5 | 14.9.5 |
| gitlab | gitlab | >= 14.10.0 < 14.10.4 | 14.10.4 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
vendor_redhat5.5MEDIUM
vendor_debian5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2wrv-52w9-gffw: When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11
ghsa_unreviewed·2022-06-07
CVE-2022-1944 [HIGH] CWE-863 GHSA-2wrv-52w9-gffw: When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11
When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs
Red Hat
kernel: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2022-48972 [MEDIUM] CWE-476 kernel: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
kernel: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
Kernel fault injection test reports null-ptr-deref as follows:
BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114
Call Trace:
raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87
call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944
unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982
unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879
register_netdevice+0x9a8/0xb90 net/core/dev.c:10083
ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659
ieee802154_register_hw+0x29c/0x330
GitLab
CVE-2022-1944: When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.
vendor_gitlab·2022-06-06·CVSS 5.4
CVE-2022-1944 [MEDIUM] CWE-863 CVE-2022-1944: When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.
CVE-2022-1944: When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs
Debian
CVE-2022-1944: gitlab - When the feature is configured, improper authorization in the Interactive Web Te...
vendor_debian·2022·CVSS 5.4
CVE-2022-1944 [MEDIUM] CVE-2022-1944: gitlab - When the feature is configured, improper authorization in the Interactive Web Te...
When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
No detection rules found.
No public exploits indexed.
2022-06-06
Published