HIGH

CVE-2022-1413

Gitlab GitLab 2022-05-19 CVSS v3.1

CVSS

7.5

Description

Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface

Summary dbcve.org

Missing input masking in GitLab CE/EE causes sensitive integration properties (such as API tokens, passwords, or secrets configured for integrations like webhooks, CI/CD, or third-party services) to be displayed in plain text within the web interface rather than being masked, allowing users with interface access to view these credentials.

Mitigation

Upgrade GitLab to version 14.8.6, 14.9.4, 14.10.1 or later. Audit user access to integration settings and rotate any credentials that may have been exposed.

Weakness (CWE)

CWE-522 Insufficiently Protected Credentials

EPSS Score

0.93%

Probability of exploitation in next 30 days

59.2th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1413.json Third Party Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/353720 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE