PT-2022-13118 · Gitlab · Gitlab

Ashish_R_Padelkar · Published 2022-03-28 · Updated 2024-03-06 · CVE-2022-0344

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 10.0 through 14.5.4 GitLab versions 10.1 through 14.6.4 GitLab versions 10.2 through 14.7.1

Description An issue in GitLab allows private project paths to be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project.

Recommendations For versions 10.0 through 14.5.4, update to version 14.5.4 or later to resolve the issue. For versions 10.1 through 14.6.4, update to version 14.6.4 or later to resolve the issue. For versions 10.2 through 14.7.1, update to version 14.7.1 or later to resolve the issue.

Exploit

Fix

Related Identifiers

BIT-GITLAB-2022-0344

CVE-2022-0344

Affected Products

Gitlab

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0344.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/37015 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0344 · Security Note
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0344.json · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2022-0344 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0344 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0344 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0344 · Vendor Advisory
• https://hackerone.com/reports/724880 · Note