CVE-2022-3351: Medium severity gitlab vulnerability

Q: What is the severity of CVE-2022-3351?

CVE-2022-3351 is classified as a medium severity vulnerability due to the potential exposure of a user's primary email.

Q: How do I fix CVE-2022-3351?

To mitigate CVE-2022-3351, upgrade GitLab to version 15.2.5 or higher, 15.3.4 or higher, or 15.4.1 or higher.

Q: Which versions of GitLab are affected by CVE-2022-3351?

CVE-2022-3351 affects GitLab EE versions starting from 13.7 before 15.2.5, 15.3 before 15.3.4, and 15.4 before 15.4.1.

Q: What data is exposed in the CVE-2022-3351 vulnerability?

CVE-2022-3351 may lead to the exposure of a user's primary email address through group member events webhooks.

Q: Is CVE-2022-3351 specific to GitLab EE?

Yes, CVE-2022-3351 specifically affects GitLab Enterprise Editions as noted in the vulnerability details.

Published Oct 17, 2022

Updated

An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user's primary email may be disclosed to an attacker through group member events webhooks.

Affected Software

3 affected components

GitLab GitLab>=13.7.0<15.2.5

GitLab GitLab>=15.3<15.3.4

GitLab GitLab>=15.4<15.4.1

Event History

Oct 17, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-3351?

CVE-2022-3351 is classified as a medium severity vulnerability due to the potential exposure of a user's primary email.

How do I fix CVE-2022-3351?

To mitigate CVE-2022-3351, upgrade GitLab to version 15.2.5 or higher, 15.3.4 or higher, or 15.4.1 or higher.

Which versions of GitLab are affected by CVE-2022-3351?