CVE-2022-1105

2022-04-0400:00:00

ubuntu.com

gitlab

access control

vulnerability

pipeline analytics

unauthorized access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.7%

JSON

An improper access control vulnerability in GitLab CE/EE affecting all
versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior
to 14.9.2 allows an unauthorized user to access pipeline analytics even
when public pipelines are disabled