Main Vulnerability Database Vulnerabilities #VU68982

Improper access control in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2022-3483

Published: November 7, 2022

Vulnerability identifier: #VU68982

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-3483

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote administrator can exfiltrate a Datadog integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2022-3483

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 15.3.5, 15.4.4, 15.5.2
GitLab Enterprise Edition - addressed in versions 15.3.5, 15.4.4, 15.5.2

External References

https://about.gitlab.com/releases/2022/11/02/security-release-gitlab-15-5-2-released/

Related Security Bulletins