CVE-2022-2501

2022-08-0500:00:00

ubuntu.com

gitlab ee

access control

ip allow-listing

bypass

artifacts

unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

53.0%

JSON

An improper access control issue in GitLab EE affecting all versions from
12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows
an attacker to bypass IP allow-listing and download artifacts. This attack
only bypasses IP allow-listing, proper permissions are still required.