CVE-2022-2456

MEDIUM

GitLab CE/EE <15.0.5, <15.1.4, <15.2.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.

References (3)

Core 3
Core References
Broken Link, Vendor Advisory x_refsource_misc
https://gitlab.com/gitlab-org/gitlab/-/issues/359910
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1536559

Scores

CVSS v3 4.9
EPSS 0.0021
EPSS Percentile 42.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

Status published
Products (2)
gitlab/gitlab 15.2 (2 CPE variants)
gitlab/gitlab < 15.0.5 (2 CPE variants)
Published Aug 05, 2022
Tracked Since Feb 18, 2026