CVE-2022-0172
First published: Tue Jan 18 2022(Updated: )
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.
Credit: cve@gitlab.com cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab GitLab | >=13.2<14.4.5 | |
| GitLab GitLab | >=13.2<14.4.5 | |
| GitLab GitLab | >=14.5.0<14.5.3 | |
| GitLab GitLab | >=14.5.0<14.5.3 | |
| GitLab GitLab | >=14.6.0<14.6.2 | |
| GitLab GitLab | >=14.6.0<14.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2022-0172.
What is the severity of CVE-2022-0172?
The severity of CVE-2022-0172 is medium, with a CVSS score of 6.5.
Which versions of GitLab are affected by CVE-2022-0172?
All versions of GitLab starting with 12.3 and up to version 14.6.2 are affected by CVE-2022-0172.
What is the issue with this vulnerability?
The vulnerability allows unauthorised users to bypass IP restrictions and access certain project information through GraphQL.
How can I fix CVE-2022-0172?
To fix CVE-2022-0172, it is recommended to update to the latest version of GitLab that includes the security patch.
- agent/references
- agent/author
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/severity
- agent/softwarecombine
- agent/event
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/gitlab
- canonical/gitlab gitlab
- version/gitlab gitlab/13.2
- version/gitlab gitlab/14.5.0
- version/gitlab gitlab/14.6.0