CVE-2022-4167

2023-01-1200:00:00

GitLab

www.cve.org

gitlab

authorization

vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.0%

JSON

Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.

CNA Affected

[
  {
    "vendor": "GitLab",
    "product": "GitLab",
    "versions": [
      {
        "version": ">=13.11, <15.5.7",
        "status": "affected"
      },
      {
        "version": ">=15.6, <15.6.4",
        "status": "affected"
      },
      {
        "version": ">=15.7, <15.7.2",
        "status": "affected"
      }
    ]
  }
]