Improper Authorization in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2022-3740
Published: December 1, 2022
Vulnerability identifier: #VU69769
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-3740
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authentication process.
The vulnerability exists due to improper authorization within the External Authorization service. A remote administrator can access git repositories and package registries by using Deploy tokens or Deploy keys.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2022-3740
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 15.3.5, 15.4.4, 15.5.2
Gitlab Community Edition - addressed in versions 15.3.5, 15.4.4, 15.5.2
Gitlab Community Edition - addressed in versions 15.3.5, 15.4.4, 15.5.2