Main Vulnerability Database Vulnerabilities #VU60891

Improper access control in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2022-0549

Published: February 28, 2022

Vulnerability identifier: #VU60891

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0549

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can add other users to groups even if that is not possible to do through the Web UI.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2022-0549

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 14.6.5, 14.7.4, 14.8.2
GitLab Enterprise Edition - addressed in versions 14.6.5, 14.7.4, 14.8.2

External References

https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/

Related Security Bulletins