PT-2022-4607 · Gitlab · Gitlab

Published 2022-08-30 · Updated 2025-05-13 · CVE-2022-2533

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 12.10 through 15.1.6 GitLab versions 15.2 through 15.2.4 GitLab versions 15.3 through 15.3.2

Description The issue is related to incorrect authentication with some Package Registries when IP address restrictions are configured in GitLab. This allows an attacker with a valid Deploy Token to misuse it from any location, bypassing existing security restrictions. The problem is associated with deficiencies in the authentication procedure.

Recommendations For GitLab versions 12.10 through 15.1.6, update to version 15.1.6 or later to resolve the issue. For GitLab versions 15.2 through 15.2.4, update to version 15.2.4 or later to resolve the issue. For GitLab versions 15.3 through 15.3.2, update to version 15.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to Package Registries or limiting the use of Deploy Tokens until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2022-05485

BIT-GITLAB-2022-2533

CVE-2022-2533

Affected Products

Gitlab

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2533.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2533 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2022-2533 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2533 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2533 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2533 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2533 · Security Note
• https://bdu.fstec.ru/vul/2022-05485 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/363863 · Note
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2533.json · Note
• https://t.me/cibsecurity/51617 · Telegram Post
• https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released · Note
• https://t.me/cvenotify/122053 · Telegram Post