PT-2022-14201 · Gitlab · Gitlab Ce/Ee+1

Published 2022-06-06 · Updated 2024-03-06 · CVE-2022-1936

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.0 through 14.9.5 GitLab EE versions 14.10.0 through 14.10.3 GitLab EE versions 15.0.0

Description The issue is related to incorrect authorization in GitLab EE, allowing an attacker with a valid Project Deploy Token to misuse it from any location, even when IP address restrictions are configured. This affects an unknown number of devices worldwide.

Recommendations For versions 12.0 through 14.9.5, update to version 14.9.5 or later. For versions 14.10.0 through 14.10.3, update to version 14.10.4 or later. For version 15.0.0, update to version 15.0.1 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-GITLAB-2022-1936

CVE-2022-1936

Affected Products

Gitlab

Gitlab Ce/Ee

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1936.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1936 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2022-1936 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1936.json · Patch
• https://osv.dev/vulnerability/CVE-2022-1936 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/363638 · Note
• https://t.me/cibsecurity/43863 · Telegram Post