CVE-2022-2227: Medium severity GitLab GitLab vulnerability
Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 14.10.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 15.0.4 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 15.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2227?
CVE-2022-2227 has a medium severity due to improper access control vulnerabilities.
How do I fix CVE-2022-2227?
To fix CVE-2022-2227, upgrade GitLab to version 14.10.5, 15.0.4, or 15.1.1 or later.
Who is affected by CVE-2022-2227?
CVE-2022-2227 affects all versions of GitLab prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1.
What types of information can be accessed due to CVE-2022-2227?
Due to CVE-2022-2227, unauthorized users can access job and project metadata.
What software versions should be updated to address CVE-2022-2227?
Update GitLab community and enterprise versions to 14.10.5, 15.0.4, or 15.1.1 to address CVE-2022-2227.