CVE-2022-0549

MEDIUM

GitLab CE/EE <14.3.6, <14.4 before 14.4.4, <14.5 before 14.5.2 - Pr...

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not possible to do through the Web UI.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Vendor Advisory x_refsource_misc
https://gitlab.com/gitlab-org/gitlab/-/issues/342448

Scores

CVSS v3 6.5
EPSS 0.0013
EPSS Percentile 31.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

Status published
Products (1)
gitlab/gitlab 13.2 - 14.6.5 (2 CPE variants)
Published Mar 28, 2022
Tracked Since Feb 18, 2026