CVE-2022-2095 — Incorrect Authorization in Gitlab

CWE-863 — Incorrect Authorization5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.6%
top 31.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedAug 5
Latest updateAug 6

Description

An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint and name when that key has write permission. Note that GitLab never asks for nor stores the private key.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶NVDgitlab/gitlab13.7.0 — 15.0.5+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=13.7, <15.0.5, >=15.1, <15.1.4, >=15.2, <15.2.1+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-hjx6-96hg-jf7x: An improper access control check in GitLab CE/EE affecting all versions starting from 13↗2022-08-06
▶
OSV
CVE-2022-2095: An improper access control check in GitLab CE/EE affecting all versions starting from 13↗2022-08-05
▶

📋Vendor Advisories

2
GitLab
CVE-2022-2095: An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.↗2022-08-05
▶
Debian
CVE-2022-2095: gitlab - An improper access control check in GitLab CE/EE affecting all versions starting...↗2022
▶