Description
An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab's Jira integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Jira issues.
References (3)
Core 3
Core References
Broken Link, Vendor Advisory x_refsource_misc
https://gitlab.com/gitlab-org/gitlab/-/issues/360800
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1538068
Vendor Advisory x_refsource_confirm
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2499.json
Scores
CVSS v3
3.5
EPSS
0.0017
EPSS Percentile
37.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Details
CWE
CWE-639
Status
published
Products (2)
gitlab/gitlab
15.2
gitlab/gitlab
13.10.0 - 15.0.5
Published
Aug 05, 2022
Tracked Since
Feb 18, 2026