MEDIUM
CVE-2022-3793
CVSS
5.3
Description
An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to.
Summary dbcve.org
An improper authorization vulnerability in GitLab CE/EE allows authenticated users to read CI/CD configuration variables from projects or pipelines they don't have access to, resulting in information disclosure.
Mitigation
Upgrade GitLab to version 15.3.5, 15.4.4, 15.5.2 or later to patch the authorization bypass.
EPSS Score
0.58%
Probability of exploitation in next 30 days
46.3th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.