CVE-2022-1999 — Incorrect User Management in Gitlab

CWE-286 — Incorrect User Management6 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 64.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedJul 1
Latest updateJul 2

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶NVDgitlab/gitlab8.13.0 — 14.10.5+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=15.0, <15.0.4, >=15.1, <15.1.1, >=8.13, <14.10.5+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-pvm7-rp3m-8gh2: An issue has been discovered in GitLab CE/EE affecting all versions from 8↗2022-07-02
▶
OSV
CVE-2022-1999: An issue has been discovered in GitLab CE/EE affecting all versions from 8↗2022-07-01
▶

📋Vendor Advisories

2
GitLab
CVE-2022-1999: An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under↗2022-07-01
▶
Debian
CVE-2022-1999: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 pr...↗2022
▶

📐Framework References

1
CWE
Incorrect User Management↗
▶