Vulnerability Details : CVE-2022-3482
Potential exploit
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only
Products affected by CVE-2022-3482
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-3482
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 45 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-3482
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
GitLab Inc. | |
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
References for CVE-2022-3482
-
https://gitlab.com/gitlab-org/gitlab/-/issues/377802
Release names visible in public projects despite release set as project members only (#377802) · Issues · GitLab.org / GitLab · GitLabExploit;Vendor Advisory
-
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3482.json
2022/CVE-2022-3482.json · master · GitLab.org / cves · GitLabVendor Advisory
-
https://hackerone.com/reports/1725841
HackerOnePermissions Required;Third Party Advisory
Jump to