CVE-2022-1983: Medium severity gitlab vulnerability
Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1983?
CVE-2022-1983 is classified as a high severity vulnerability due to incorrect authorization in GitLab EE.
How do I fix CVE-2022-1983?
To remediate CVE-2022-1983, upgrade GitLab EE to version 14.10.5, 15.0.4, or 15.1.1 or later.
What versions are affected by CVE-2022-1983?
CVE-2022-1983 affects all GitLab EE versions from 10.7 before 14.10.5, 15.0 before 15.0.4, and 15.1 before 15.1.1.
Who can exploit CVE-2022-1983?
An attacker with a valid Deploy Key or Deploy Token can exploit CVE-2022-1983 to gain unauthorized access to Container Registries.
What kind of access does CVE-2022-1983 permit?
CVE-2022-1983 allows unauthorized access to Container Registries from any location, bypassing IP address restrictions.