CVE-2022-0172: Medium severity gitlab vulnerability
Published Jan 18, 2022
·Updated
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.
Affected Software
6 affected components
GitLab GitLab>=13.2<14.4.5
GitLab GitLab>=13.2<14.4.5
GitLab GitLab>=14.5.0<14.5.3
GitLab GitLab>=14.5.0<14.5.3
GitLab GitLab>=14.6.0<14.6.2
GitLab GitLab>=14.6.0<14.6.2
Event History
Jan 18, 2022
CVE Published
via MITRE·04:51 PM
Data Sourced
via MITRE·04:51 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2022-0172.
2
What is the severity of CVE-2022-0172?
The severity of CVE-2022-0172 is medium, with a CVSS score of 6.5.
3
Which versions of GitLab are affected by CVE-2022-0172?
All versions of GitLab starting with 12.3 and up to version 14.6.2 are affected by CVE-2022-0172.
4
What is the issue with this vulnerability?
The vulnerability allows unauthorised users to bypass IP restrictions and access certain project information through GraphQL.
5
How can I fix CVE-2022-0172?
To fix CVE-2022-0172, it is recommended to update to the latest version of GitLab that includes the security patch.