First published: Tue Jan 17 2023(Updated: )
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It was possible to read repository content by an unauthorised user if a project member used a crafted link.
Credit: cve@gitlab.com
Affected Software | Affected Version | How to fix |
---|---|---|
GitLab GitLab | >=12.9<15.1.6 | |
GitLab GitLab | >=12.9<=15.1.6 | |
GitLab GitLab | >=15.2.0<15.2.4 | |
GitLab GitLab | >=15.2.0<15.2.4 | |
GitLab GitLab | >=15.3.0<15.3.2 | |
GitLab GitLab | >=15.3.0<15.3.2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2022-2907 is a vulnerability in GitLab CE/EE that allows unauthorized users to read repository content.
All versions of GitLab starting from 12.9 before 15.1.6, starting from 15.2 before 15.2.4, and starting from 15.3 before 15.3.2 are affected by CVE-2022-2907.
The severity of CVE-2022-2907 is medium with a CVSS score of 6.5.
An unauthorized user can read repository content in GitLab CE/EE if a project member uses a crafted link.
You can find more information about CVE-2022-2907 in the GitLab CE/EE security advisory, the GitLab issue tracker, and the HackerOne report.