PT-2023-13635 · Gitlab · Gitlab Ce/Ee+1

Nocasi · Publicado 2023-01-12 · Atualizado 2025-04-09 · CVE-2022-3870

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.0 through 15.5.7 GitLab CE/EE versions 15.6 through 15.6.4 GitLab CE/EE versions 15.7 through 15.7.2

Description An issue has been discovered in GitLab CE/EE that allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.

Recommendations For versions 10.0 through 15.5.7, update to version 15.5.7 or later. For versions 15.6 through 15.6.4, update to version 15.6.4 or later. For versions 15.7 through 15.7.2, update to version 15.7.2 or later. As a temporary workaround, consider restricting access to user avatars on private instances until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BIT-GITLAB-2022-3870

CVE-2022-3870

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3870.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/381647 · Exploit
• https://t.me/cvenotify/118446 · Publicação no Telegram
• https://hackerone.com/reports/1753423 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3870 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-3870 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-gitlab-2022-3870 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2022-3870 · Nota de Segurança
• https://ubuntu.com/security/CVE-2022-3870 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-3870 · Aviso do Fabricante
• https://t.me/cibsecurity/56407 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3870 · Aviso do Fabricante
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3870.json · Aviso do Fabricante