CVE-2022-2244
published 2022-07-01CVE-2022-2244: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.79%
51.6th percentile
An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.8.0 < 14.10.5 | 14.10.5 |
| gitlab | gitlab | >= 15.0.0 < 15.0.4 | 15.0.4 |
| gitlab | gitlab_ee | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2022-2244: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.
vendor_gitlab·2022-07-01·CVSS 4.3
CVE-2022-2244 [MEDIUM] CVE-2022-2244: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.
CVE-2022-2244: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature.
Debian
CVE-2022-2244: gitlab - An improper authorization vulnerability in GitLab EE/CE affecting all versions f...
vendor_debian·2022·CVSS 4.3
CVE-2022-2244 [MEDIUM] CVE-2022-2244: gitlab - An improper authorization vulnerability in GitLab EE/CE affecting all versions f...
An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-4wc6-q22j-fx9w: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14
ghsa_unreviewed·2022-07-02
CVE-2022-2244 [MEDIUM] CWE-863 GHSA-4wc6-q22j-fx9w: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14
An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature.
OSV
CVE-2022-2244: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14
osv·2022-07-01·CVSS 4.3
CVE-2022-2244 [MEDIUM] CVE-2022-2244: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14
An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2244.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/360666https://hackerone.com/reports/1619583https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2244.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/360666https://hackerone.com/reports/1619583
2022-07-01
Published