CVE-2022-2307
First published: Fri Aug 05 2022(Updated: )
A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=13.0.0<15.0.5 | |
| GitLab | >=15.1.0<15.1.4 | |
| GitLab | =15.2 | |
| GitLab | >=13.0.0<15.0.5 | |
| GitLab | >=15.1.0<15.1.4 | |
| GitLab | =15.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-2307?
CVE-2022-2307 is considered a moderate severity vulnerability due to the implications of retained access tokens after group deletion.
How do I fix CVE-2022-2307?
To fix CVE-2022-2307, upgrade to GitLab versions 15.0.5, 15.1.4, or 15.2.1 or later.
Who does CVE-2022-2307 affect?
CVE-2022-2307 affects all GitLab Community and Enterprise editions from version 13.0 to just before 15.0.5, as well as those from 15.1 to just before 15.1.4 and version 15.2.
What type of attack does CVE-2022-2307 enable?
CVE-2022-2307 allows a malicious Group Owner to retain usable Group Access Tokens even after the group has been deleted.
Can I check for CVE-2022-2307 on my GitLab instance?
Yes, you can check for CVE-2022-2307 by reviewing your GitLab version against the affected versions and ensuring you update accordingly.
- agent/references
- agent/type
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/13.0.0
- version/gitlab/15.1.0
- version/gitlab/15.2