CVE-2022-4343: Exposure of Sensitive Information to an Unauthorized Actor in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-4343?
CVE-2022-4343 is an issue discovered in GitLab EE that can potentially allow a project member to leak stored credentials.
Which versions of GitLab EE are affected by CVE-2022-4343?
Versions starting from 13.12 before 16.1.5, versions starting from 16.2 before 16.2.5, and version 16.3 before 16.3.1 of GitLab EE are affected by CVE-2022-4343.
What is the severity of CVE-2022-4343?
The severity of CVE-2022-4343 is medium with a severity value of 4.3.
How can a project member leak credentials in GitLab EE due to CVE-2022-4343?
A project member can leak credentials stored in the site profile due to the vulnerability in GitLab EE.
How can I fix CVE-2022-4343 in GitLab EE?
To fix CVE-2022-4343 in GitLab EE, you should update to version 16.1.5, 16.2.5, or 16.3.1 or later.