CVE-2022-3325 — Improper Access Control in Gitlab

CWE-284 — Improper Access ControlCWE-732 — Incorrect Permission Assignment5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 68.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedOct 17

Description

Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶NVDgitlab/gitlab12.8.0 — 15.2.5+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=12.8, <15.2.5, >=15.3, <15.3.4, >=15.4, <15.4.1+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2022-3325: Improper access control in the GitLab CE/EE API affecting all versions starting from 12↗2022-10-17
▶
GHSA
GHSA-339r-94ww-rwcq: Improper access control in the GitLab CE/EE API affecting all versions starting from 12↗2022-10-17
▶

📋Vendor Advisories

2
GitLab
CVE-2022-3325: Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4↗2022-10-17
▶
Debian
CVE-2022-3325: gitlab - Improper access control in the GitLab CE/EE API affecting all versions starting ...↗2022
▶