CVE-2022-3351

An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user's primary email may be disclosed to an attacker through group member events webhooks.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3351.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/364266	Broken Link Vendor Advisory
https://hackerone.com/reports/1446022	Permissions Required Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3351.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/364266	Broken Link Vendor Advisory
https://hackerone.com/reports/1446022	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

21 Nov 2024, 07:19

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3351.json - Vendor Advisory~~	() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3351.json - Vendor Advisory
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/364266 - Broken Link, Vendor Advisory~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/364266 - Broken Link, Vendor Advisory
References	~~() https://hackerone.com/reports/1446022 - Permissions Required, Third Party Advisory~~	() https://hackerone.com/reports/1446022 - Permissions Required, Third Party Advisory

08 Aug 2023, 14:22

Type	Values Removed	Values Added
CWE	~~CWE-200~~	NVD-CWE-noinfo

Information

Published : 2022-10-17 16:15

Updated : 2024-11-21 07:19

NVD link : CVE-2022-3351

Mitre link : CVE-2022-3351

CVE.ORG link : CVE-2022-3351

JSON object : View

Products Affected

gitlab

gitlab

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-3351", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-10-17T16:15:22.900", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3351.json", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/364266", "tags": ["Broken Link", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/1446022", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3351.json", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/364266", "tags": ["Broken Link", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://hackerone.com/reports/1446022", "tags": ["Permissions Required", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user's primary email may be disclosed to an attacker through group member events webhooks."}, {"lang": "es", "value": "Se ha detectado un problema en GitLab EE afectando a todas las versiones a partir de 13.7 anteriores a 15.2.5, a todas las versiones a partir de 15.3 anteriores a 15.3.4, a todas las versiones a partir de 15.4 anteriores a 15.4.1. El correo electr\u00f3nico principal de un usuario puede ser divulgado a un atacante mediante los webhooks de eventos de miembros del grupo"}], "lastModified": "2024-11-21T07:19:21.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "3073D046-63A0-4514-8398-93E0DF38CBFF", "versionEndExcluding": "15.2.5", "versionStartIncluding": "13.7.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "3A4CDDAE-AEDA-40D8-9D36-11535172233D", "versionEndExcluding": "15.3.4", "versionStartIncluding": "15.3"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "1605D4DC-D7EA-42BC-B006-8A79C32781CE", "versionEndExcluding": "15.4.1", "versionStartIncluding": "15.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}