CVE-2022-1783: Medium severity gitlab vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for malicious group maintainers to add new members to a project within their group, through the REST API, even after their group owner enabled a setting to prevent members from being added to projects within that group.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1783?
CVE-2022-1783 has a medium severity rating that could allow malicious group maintainers to manipulate project group membership.
How do I fix CVE-2022-1783?
To fix CVE-2022-1783, upgrade GitLab to version 14.9.5 or later, 14.10.4 or later, or 15.0.1.
Which versions of GitLab are affected by CVE-2022-1783?
CVE-2022-1783 affects all versions of GitLab CE/EE starting from 14.3 up to but not including 14.9.5, from 14.10 up to but not including 14.10.4, and from 15.0 up to but not including 15.0.1.
What are the potential impacts of CVE-2022-1783?
The potential impact of CVE-2022-1783 includes unauthorized modification of project group membership by malicious group maintainers.
Is CVE-2022-1783 related to user permissions in GitLab?
Yes, CVE-2022-1783 is directly related to user permissions, allowing improper addition of members within GitLab project groups.