VulnerabilityModified
CVE-2022-3482
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project…
MEDIUM 5.3EPSS 1.04%
Does this matter?
Lower severity and a low EPSS score (1.04%). Track it; it rarely justifies an emergency change on its own.
Description
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.04% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3482.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/377802Exploit, Vendor Advisory
- https://hackerone.com/reports/1725841Permissions Required, Third Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3482.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/377802Exploit, Vendor Advisory
- https://hackerone.com/reports/1725841Permissions Required, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.