PT-2022-2255 · Gitlab · Gitlab Ce/Ee+1

Published 2022-02-25 · Updated 2026-05-26 · CVE-2022-0735

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.10 through 14.6.4 GitLab CE/EE versions 14.7 through 14.7.3 GitLab CE/EE versions 14.8 through 14.8.1

Description An issue has been discovered in GitLab CE/EE, allowing an unauthorized user to steal runner registration tokens through an information disclosure vulnerability using quick actions commands. The vulnerability is related to deficiencies in the authorization mechanism, which can be exploited by a remote attacker to gain unauthorized access to protected information using specially crafted commands. The issue is caused by an information leak when using Quick Actions commands.

Recommendations For GitLab CE/EE versions 12.10 through 14.6.4, update to version 14.6.5 or later. For GitLab CE/EE versions 14.7 through 14.7.3, update to version 14.7.4 or later. For GitLab CE/EE versions 14.8 through 14.8.1, update to version 14.8.2 or later. As a temporary workaround, consider restricting access to Quick Actions commands until a patch is available.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

BDU:2022-02363

BIT-GITLAB-2022-0735

CVE-2022-0735

Affected Products

Gitlab

Gitlab Ce/Ee

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0735.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0735 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0735 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0735 · Security Note
• https://ubuntu.com/security/CVE-2022-0735 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0735.json · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0735 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2022-0735 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02363 · Security Note
• https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released · Note
• https://reddit.com/r/Network/comments/1tnvomo/threat_intel_may_22_2026_vulnerability · Reddit Post
• https://t.me/tmfeed/135918 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/353529 · Note
• https://t.me/tmfeed/135811 · Telegram Post
• https://t.me/nekaspersky/1928 · Telegram Post