Main Vulnerability Database Vulnerabilities #VU65885

Improper Authentication in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2022-2303

Published: July 29, 2022

Vulnerability identifier: #VU65885

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2303

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote user can bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2022-2303

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 15.0.5, 15.1.4, 15.2.1
GitLab Enterprise Edition - addressed in versions 15.0.5, 15.1.4, 15.2.1

External References

https://about.gitlab.com/releases/2022/07/28/security-release-gitlab-15-2-1-released/

Related Security Bulletins