CVE-2022-1936: Medium severity gitlab vulnerability
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1936?
CVE-2022-1936 is considered a high severity vulnerability due to its potential to allow unauthorized access to sensitive project data.
How do I fix CVE-2022-1936?
To mitigate CVE-2022-1936, update GitLab to version 14.9.5 or higher, or to any version within the 14.10.x or 15.0.x series that is not affected.
Who is affected by CVE-2022-1936?
CVE-2022-1936 affects GitLab EE users on versions from 12.0 before 14.9.5, from 14.10 before 14.10.4, and 15.0 before 15.0.1.
What type of vulnerability is CVE-2022-1936?
CVE-2022-1936 is classified as an authorization vulnerability that can be exploited to misuse Project Deploy Tokens.
Can I check the status of CVE-2022-1936 fixes in my environment?
Yes, you can check your GitLab version against the fixed versions mentioned in the CVE description to ensure you are not vulnerable.