MEDIUM

CVE-2022-3820

Gitlab GitLab 2023-01-26 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.

Weakness (CWE)

CWE-290

EPSS Score

0.73%

Probability of exploitation in next 30 days

52.6th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3820.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/378638 Exploit, Issue Tracking, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE