cve-2022-1105
Vulnerability from cvelistv5
Published
2022-04-04 19:46
Modified
2024-08-02 23:55
Severity
Summary
An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled
References
Source | URL | Tags |
---|---|---|
cve@gitlab.com | https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json | Vendor Advisory |
cve@gitlab.com | https://gitlab.com/gitlab-org/gitlab/-/issues/335933 | Broken Link |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:55:22.835Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/335933" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "GitLab", "vendor": "GitLab", "versions": [ { "status": "affected", "version": "\u003e=13.11, \u003c14.7.7" }, { "status": "affected", "version": "\u003e=14.8, \u003c14.8.5" }, { "status": "affected", "version": "\u003e=14.9, \u003c14.9.2" } ] } ], "credits": [ { "lang": "en", "value": "This vulnerability has been discovered internally by the GitLab team" } ], "descriptions": [ { "lang": "en", "value": "An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "description": "Improper access control in GitLab", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-04-04T19:46:04", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/335933" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@gitlab.com", "ID": "CVE-2022-1105", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "GitLab", "version": { "version_data": [ { "version_value": "\u003e=13.11, \u003c14.7.7" }, { "version_value": "\u003e=14.8, \u003c14.8.5" }, { "version_value": "\u003e=14.9, \u003c14.9.2" } ] } } ] }, "vendor_name": "GitLab" } ] } }, "credit": [ { "lang": "eng", "value": "This vulnerability has been discovered internally by the GitLab team" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled" } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Improper access control in GitLab" } ] } ] }, "references": { "reference_data": [ { "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/335933", "refsource": "MISC", "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/335933" }, { "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json", "refsource": "CONFIRM", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json" } ] } } } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2022-1105", "datePublished": "2022-04-04T19:46:04", "dateReserved": "2022-03-26T00:00:00", "dateUpdated": "2024-08-02T23:55:22.835Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-1105\",\"sourceIdentifier\":\"cve@gitlab.com\",\"published\":\"2022-04-04T20:15:09.703\",\"lastModified\":\"2023-08-08T14:21:49.707\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de control de acceso inapropiado en GitLab CE/EE afectando a todas las versiones desde 13.11 hasta 14.7.7, 14.8 hasta 14.8.5 y 14.9 hasta 14.9.2, permite que un usuario no autorizado acceda a los an\u00e1lisis de canalizaciones incluso cuando las canalizaciones p\u00fablicas est\u00e1n deshabilitadas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4},{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"13.11.0\",\"versionEndExcluding\":\"14.7.7\",\"matchCriteriaId\":\"2F61287B-7BCA-45AA-BC79-3FECEFFCAA6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"13.11.0\",\"versionEndExcluding\":\"14.7.7\",\"matchCriteriaId\":\"DAF7F003-7EA5-47B3-8088-702D9EF48CA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"14.8.0\",\"versionEndExcluding\":\"14.8.5\",\"matchCriteriaId\":\"723E51BE-5A83-439E-8D37-EACDC4E5E6B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"14.8.0\",\"versionEndExcluding\":\"14.8.5\",\"matchCriteriaId\":\"B21DB80A-89B0-4821-AACD-A0DB4102C123\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"14.9.0\",\"versionEndExcluding\":\"14.9.2\",\"matchCriteriaId\":\"50473ACF-87F3-4919-A1C8-1C1D3AED7024\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"14.9.0\",\"versionEndExcluding\":\"14.9.2\",\"matchCriteriaId\":\"84DA7B4F-42A6-4940-98D5-3BF151FD3287\"}]}]}],\"references\":[{\"url\":\"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json\",\"source\":\"cve@gitlab.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://gitlab.com/gitlab-org/gitlab/-/issues/335933\",\"source\":\"cve@gitlab.com\",\"tags\":[\"Broken Link\"]}]}}" } }
Loading...