4.3

CVE-2022-3331

Exploit
An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Zentao project issues.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ GitLab SwEdition enterprise Version >= 14.5 < 15.1.6
Gitlab ≫ GitLab SwEdition enterprise Version >= 15.2 < 15.2.4
Gitlab ≫ GitLab SwEdition enterprise Version >= 15.3 < 15.3.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.61% 0.461
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
cve@gitlab.com 3.5 1.8 1.4
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3331.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/360372
Vendor Advisory
Exploit
Issue Tracking
https://hackerone.com/reports/1542834
Third Party Advisory
Permissions Required