CVE-2022-2227

🗓️ 01 Jul 2022 15:53:58Reported by GitLabType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 2277 Views

Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain condition

Reporter	Title	Published	Views	Family All 21
ATTACKERKB	CVE-2022-2227	1 Jul 202216:15	–	attackerkb
Circl	CVE-2022-2227	1 Jul 202220:42	–	circl
CNNVD	GitLab 访问控制错误漏洞	1 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-2227	1 Jul 202215:53	–	cvelist
FreeBSD	Gitlab -- multiple vulnerabilities	30 Jun 202200:00	–	freebsd
Debian CVE	CVE-2022-2227	1 Jul 202215:53	–	debiancve
EUVD	EUVD-2022-34507	3 Oct 202520:07	–	euvd
Tenable Nessus	FreeBSD : Gitlab -- multiple vulnerabilities (d1b35142-ff4a-11ec-8be3-001b217b3468)	9 Jul 202200:00	–	nessus
Tenable Nessus	GitLab < 14.10.5 (CVE-2022-2227)	29 Jul 202200:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2022-2227	26 Aug 202500:00	–	nessus

NVD

Vulners

Node

gitlab gitlabRange<14.10.5community

gitlab gitlabRange<14.10.5enterprise

gitlab gitlabRange15.0.0–15.0.4community

gitlab gitlabRange15.0.0–15.0.4enterprise

gitlab gitlabMatch15.1.0community

gitlab gitlabMatch15.1.0enterprise

[
  {
    "product": "GitLab",
    "vendor": "GitLab",
    "versions": [
      {
        "status": "affected",
        "version": "<14.10.5"
      },
      {
        "status": "affected",
        "version": ">=15.0, <15.0.4"
      },
      {
        "status": "affected",
        "version": ">=15.1, <15.1.1"
      }
    ]
  }
]

Source	Link
gitlab	www.gitlab.com/gitlab-org/gitlab/-/issues/300842
hackerone	www.hackerone.com/reports/1092199
gitlab	www.gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2227.json

17 Jun 2026 04:41Current

4.5Medium risk

Vulners AI Score4.5

CVSS 23.5

CVSS 3.13.1 - 4.3

EPSS0.00633

CWE-732

cve-2022-2227 gitlab ce ee access control runner jobs api