MEDIUM

CVE-2022-2534

Gitlab GitLab 2022-08-05 CVSS v3.1

CVSS

5.3

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration.

Summary dbcve.org

GitLab CE/EE versions prior to 15.0.5, 15.1.4, and 15.2.1 contain an information disclosure vulnerability in the Datadog integration where contributor email addresses were being improperly returned/exposed due to faulty data handling.

Mitigation

Upgrade GitLab to version 15.0.5 or later (for 14.x and earlier branches), 15.1.4 or later, or 15.2.1 or later. Alternatively, temporarily disable the Datadog integration if upgrading is not immediately feasible.

EPSS Score

0.63%

Probability of exploitation in next 30 days

49th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2534.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/361654 Broken Link, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE