MEDIUM

CVE-2022-2907

Gitlab GitLab 2023-01-17 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It was possible to read repository content by an unauthorised user if a project member used a crafted link.

Summary dbcve.org

An IDOR vulnerability in GitLab CE/EE allowed unauthorized users to read repository content via a crafted link shared by a project member. The flaw permitted bypass of access controls by manipulating URLs or parameters to access repository data outside authorized scope.

Mitigation

Upgrade GitLab to version 15.1.6, 15.2.4, or 15.3.2 or later to patch the unauthorized repository access vulnerability.

Weakness (CWE)

CWE-200 Information Exposure

EPSS Score

0.94%

Probability of exploitation in next 30 days

59.4th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2907.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/349388 Broken Link https://hackerone.com/reports/1417680 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE