CVE-2022-3413

Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/374926	Broken Link Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/374926	Broken Link Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

21 Nov 2024, 07:19

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json - Vendor Advisory~~	() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json - Vendor Advisory
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/374926 - Broken Link, Vendor Advisory~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/374926 - Broken Link, Vendor Advisory

08 Aug 2023, 14:22

Type	Values Removed	Values Added
CWE	~~CWE-863~~	CWE-639

Information

Published : 2022-11-10 00:15

Updated : 2024-11-21 07:19

NVD link : CVE-2022-3413

Mitre link : CVE-2022-3413

CVE.ORG link : CVE-2022-3413

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2022-3413", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-11-10T00:15:20.737", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/374926", "tags": ["Broken Link", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/374926", "tags": ["Broken Link", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above."}, {"lang": "es", "value": "La autorizaci\u00f3n incorrecta durante la visualizaci\u00f3n de eventos de auditor\u00eda en GitLab EE que afecta a todas las versiones desde 14.5 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2, permiti\u00f3 a los desarrolladores ver los eventos de auditor\u00eda del proyecto y a los desarrolladores o mantenedores ver los Eventos de Auditor\u00eda del grupo. Estos deber\u00edan haber estado restringidos a mantenedores de proyectos, propietarios de grupos y superiores."}], "lastModified": "2024-11-21T07:19:27.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "ED059E2E-B69C-4D8C-8FCD-966700E6DC7E", "versionEndExcluding": "15.3.5", "versionStartIncluding": "14.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "2FBFF5F6-6C42-4E64-8177-1BED65D38B00", "versionEndExcluding": "15.4.4", "versionStartIncluding": "15.4.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "CE5ABA53-66D4-4BDE-BE64-AB45EFDADE24", "versionEndExcluding": "15.5.2", "versionStartIncluding": "15.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}