Improper access control in GitLab Enterprise Edition - CVE-2022-2498
Published: July 29, 2022
Vulnerability identifier: #VU65873
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-2498
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in pipeline subscriptions. A remote user can trigger new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author.
Affected software
GitLab Enterprise Edition
How to mitigate CVE-2022-2498
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 15.0.5, 15.1.4, 15.2.1