CVE-2022-3482
published 2023-01-26CVE-2022-3482: An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.03%
59.6th percentile
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 11.3.0 < 15.4.6 | 15.4.6 |
| gitlab | gitlab | >= 15.5.0 < 15.5.5 | 15.5.5 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qhh9-23rj-2x83: An improper access control issue in GitLab CE/EE affecting all versions from 11
ghsa_unreviewed·2023-01-26
CVE-2022-3482 [MEDIUM] GHSA-qhh9-23rj-2x83: An improper access control issue in GitLab CE/EE affecting all versions from 11
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only
OSV
CVE-2022-3482: An improper access control issue in GitLab CE/EE affecting all versions from 11
osv·2023-01-26·CVSS 5.3
CVE-2022-3482 [MEDIUM] CVE-2022-3482: An improper access control issue in GitLab CE/EE affecting all versions from 11
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only
GitLab
CVE-2022-3482: An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allo
vendor_gitlab·2023-01-26·CVSS 5.3
CVE-2022-3482 [MEDIUM] CWE-862 CVE-2022-3482: An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allo
CVE-2022-3482: An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only
Debian
CVE-2022-3482: gitlab - An improper access control issue in GitLab CE/EE affecting all versions from 11....
vendor_debian·2022·CVSS 5.3
CVE-2022-3482 [MEDIUM] CVE-2022-3482: gitlab - An improper access control issue in GitLab CE/EE affecting all versions from 11....
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3482.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/377802https://hackerone.com/reports/1725841https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3482.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/377802https://hackerone.com/reports/1725841
2023-01-26
Published