PT-2023-13635 · Gitlab · Gitlab Ce/Ee+1

Nocasi · Published 2023-01-12 · Updated 2025-04-09 · CVE-2022-3870

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.0 through 15.5.7 GitLab CE/EE versions 15.6 through 15.6.4 GitLab CE/EE versions 15.7 through 15.7.2

Description An issue has been discovered in GitLab CE/EE that allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.

Recommendations For versions 10.0 through 15.5.7, update to version 15.5.7 or later. For versions 15.6 through 15.6.4, update to version 15.6.4 or later. For versions 15.7 through 15.7.2, update to version 15.7.2 or later. As a temporary workaround, consider restricting access to user avatars on private instances until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-GITLAB-2022-3870

CVE-2022-3870

Affected Products

Gitlab

Gitlab Ce/Ee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3870.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/381647 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3870 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2022-3870 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3870 · Security Note
• https://ubuntu.com/security/CVE-2022-3870 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3870 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3870 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3870.json · Vendor Advisory
• https://t.me/cvenotify/118446 · Telegram Post
• https://hackerone.com/reports/1753423 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3870 · Note
• https://t.me/cibsecurity/56407 · Telegram Post