Muthu_Prakash

#20978of 53,633

11.8Total CVSS

Vulnerabilities · 3

Low

1

Medium

2

Gitlab · Gitlab Ce/Ee · CVE-2022-1981

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 12.2 through 14.10.5 GitLab EE versions 15.0 through 15.0.4 GitLab EE versions 15.1 through 15.1.1 **Description** An issue has been discovered in GitLab EE where the domain allow-list can be bypassed. This occurs when a group enables the setting to restrict access to users belonging to specific domains, and a Maintainer uses the 'Invite a group' feature to invite a group with members that don't comply with the domain allow-list. **Recommendations** For GitLab EE versions 12.2 through 14.10.5, update to version 14.10.5 or later. For GitLab EE versions 15.0 through 15.0.4, update to version 15.0.4 or later. For GitLab EE versions 15.1 through 15.1.1, update to version 15.1.1 or later. As a temporary workaround, consider restricting the use of the 'Invite a group' feature until the issue is resolved.

Gitlab · Gitlab Ce/Ee · CVE-2021-39945

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 9.4 through 14.3.5 GitLab CE/EE versions 14.4 through 14.4.3 GitLab CE/EE versions 14.5 through 14.5.1 **Description** The issue is related to improper access control in the GitLab CE/EE API. This allows an author of a Merge Request to approve the Merge Request even after having their project access revoked. **Recommendations** For versions 9.4 through 14.3.5, update to version 14.3.6 or later. For versions 14.4 through 14.4.3, update to version 14.4.4 or later. For versions 14.5 through 14.5.1, update to version 14.5.2 or later.

Gitlab · Gitlab · CVE-2021-22176

Name of the Vulnerable Software and Affected Versions: GitLab versions 3.0.1 and later Description: An issue has been discovered in GitLab where improper access control allows demoted project members to access details on authored merge requests. Recommendations: For GitLab versions 3.0.1 and later, update to a version that includes the fix for this issue to prevent demoted project members from accessing sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.