FKIE_CVE-2022-1105

Vulnerability from fkie_nvd - Published: 2022-04-04 20:15 - Updated: 2024-11-21 06:40
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled
References
cve@gitlab.comhttps://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.jsonVendor Advisory
cve@gitlab.comhttps://gitlab.com/gitlab-org/gitlab/-/issues/335933Broken Link
af854a3a-2127-422b-91ae-364da2661108https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.jsonVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://gitlab.com/gitlab-org/gitlab/-/issues/335933Broken Link
Impacted products
Vendor Product Version
gitlab gitlab *
gitlab gitlab *
gitlab gitlab *
gitlab gitlab *
gitlab gitlab *
gitlab gitlab *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "matchCriteriaId": "2F61287B-7BCA-45AA-BC79-3FECEFFCAA6F",
              "versionEndExcluding": "14.7.7",
              "versionStartIncluding": "13.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "DAF7F003-7EA5-47B3-8088-702D9EF48CA0",
              "versionEndExcluding": "14.7.7",
              "versionStartIncluding": "13.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "matchCriteriaId": "723E51BE-5A83-439E-8D37-EACDC4E5E6B2",
              "versionEndExcluding": "14.8.5",
              "versionStartIncluding": "14.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B21DB80A-89B0-4821-AACD-A0DB4102C123",
              "versionEndExcluding": "14.8.5",
              "versionStartIncluding": "14.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "matchCriteriaId": "50473ACF-87F3-4919-A1C8-1C1D3AED7024",
              "versionEndExcluding": "14.9.2",
              "versionStartIncluding": "14.9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "84DA7B4F-42A6-4940-98D5-3BF151FD3287",
              "versionEndExcluding": "14.9.2",
              "versionStartIncluding": "14.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de control de acceso inapropiado en GitLab CE/EE afectando a todas las versiones desde 13.11 hasta 14.7.7, 14.8 hasta 14.8.5 y 14.9 hasta 14.9.2, permite que un usuario no autorizado acceda a los an\u00e1lisis de canalizaciones incluso cuando las canalizaciones p\u00fablicas est\u00e1n deshabilitadas"
    }
  ],
  "id": "CVE-2022-1105",
  "lastModified": "2024-11-21T06:40:02.733",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "cve@gitlab.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-04-04T20:15:09.703",
  "references": [
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Broken Link"
      ],
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/335933"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/335933"
    }
  ],
  "sourceIdentifier": "cve@gitlab.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.