CVE-2022-1936

MEDIUM

GitLab 12.0.0-14.9.4, 14.10.0-14.10.3, 15.0.0 - Incorrect Authorization via Project Deploy Token

Title source: llm
STIX 2.1

Description

Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0017
EPSS Percentile 37.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-863
Status published
Products (2)
gitlab/gitlab 15.0.0
gitlab/gitlab 12.0.0 - 14.9.5
Published Jun 06, 2022
Tracked Since Feb 18, 2026