CVE-2022-1423: High severity gitlab vulnerability
Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1423?
CVE-2022-1423 is considered a high severity vulnerability due to its potential for cache poisoning by malicious actors with Developer privileges.
How do I fix CVE-2022-1423?
To mitigate CVE-2022-1423, upgrade GitLab to version 14.8.6 or later, or version 14.9.4 or later, or version 14.10.1 or later.
Who is affected by CVE-2022-1423?
CVE-2022-1423 affects all GitLab CE/EE versions from 1.0.2 before 14.8.6, from 14.9.0 before 14.9.4, and from 14.10.0 before 14.10.1.
What type of vulnerability is CVE-2022-1423?
CVE-2022-1423 is classified as an improper access control vulnerability within the CI/CD cache mechanism.
Can a user with lower privileges exploit CVE-2022-1423?
No, CVE-2022-1423 requires a user to have Developer privileges to exploit the vulnerability.