CVE-2022-1999

An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description.

CVSS v3 3.1 LOW
CVSS v2.0 4.3 MEDIUM

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1999.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/357963	Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1999.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/357963	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:15.1.0::::community:::
	cpe:2.3:a:gitlab:gitlab:15.1.0::::enterprise:::

History

21 Nov 2024, 06:41

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1999.json - Vendor Advisory~~	() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1999.json - Vendor Advisory
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/357963 - Broken Link~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/357963 - Broken Link
CVSS	v2 : ~~4.3~~ v3 : ~~5.3~~	v2 : 4.3 v3 : 3.1

Information

Published : 2022-07-01 17:15

Updated : 2024-11-21 06:41

NVD link : CVE-2022-1999

Mitre link : CVE-2022-1999

CVE.ORG link : CVE-2022-1999

JSON object : View

Products Affected

gitlab

gitlab

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-1999", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-07-01T17:15:07.283", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1999.json", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/357963", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1999.json", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/357963", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description."}, {"lang": "es", "value": "Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones desde la 8.13 anteriores a 14.10.5, la 15.0 anteriores a 15.0.4 y la 15.1 anteriores a 15.1.1. Bajo determinadas condiciones, usando la API REST un usuario no privilegiado pod\u00eda cambiar la descripci\u00f3n de las etiquetas"}], "lastModified": "2024-11-21T06:41:55.330", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "E50D4514-ED7E-42A3-A99E-4F03D651F7B1", "versionEndExcluding": "14.10.5", "versionStartIncluding": "8.13.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "BDCBE009-B48B-4B42-B0C5-789FCB1B7116", "versionEndExcluding": "14.10.5", "versionStartIncluding": "8.13.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "59BC7D90-71FE-4551-BC55-2CBDD7F037C3", "versionEndExcluding": "15.0.4", "versionStartIncluding": "15.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "18F6B2F9-8BDA-41C7-8152-70D61CCCC0B8", "versionEndExcluding": "15.0.4", "versionStartIncluding": "15.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:15.1.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "0CE56232-8EF7-428C-90F2-85803A66B664"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:15.1.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E07D39FA-8428-4585-9A4C-55D2A1799F9E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}