CVE-2022-3740 — Improper Authorization in Gitlab

CWE-285 — Improper AuthorizationCWE-863 — Incorrect Authorization6 documents6 sources
Severity
4.9MEDIUMNVD
EPSS
0.2%
top 59.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedJan 26

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys .

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages5 packages

▶NVDgitlab/gitlab12.9.0 — 15.4.6+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=12.9, <15.4.6, >=15.5, <15.5.5, >=15.6, <15.6.1+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-52w5-6rqq-mwq5: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12↗2023-01-26
▶
OSV
CVE-2022-3740: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12↗2023-01-26
▶

📋Vendor Advisories

3
GitLab
CVE-2022-3740: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2↗2023-01-26
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: Installer (RSA BSAFE Crypto-J) — CVE-2019-3740↗2022-04-15
▶
Debian
CVE-2022-3740: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro...↗2022
▶