Business Logic Errors in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2022-1111
Published: April 1, 2022
Vulnerability identifier: #VU61793
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1111
CWE-ID: CWE-840
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to a business logic error in Project Import. A remote administrator can cause imported projects to show an incorrect user in the "Access Granted" column in the project membership pages.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2022-1111
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 14.7.7, 14.8.5, 14.9.2
Gitlab Community Edition - addressed in versions 14.7.7, 14.8.5, 14.9.2
Gitlab Community Edition - addressed in versions 14.7.7, 14.8.5, 14.9.2