Lucene search

Veracode Vulnerability DatabaseVERACODE:41482

HistoryJul 22, 2023 - 9:04 p.m.

Information Disclosure

2023-07-2221:04:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

gitlab

information disclosure

vulnerability

authorization issue

trace log

jobs

sensitive information

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

29.6%

JSON

gitlab is vulnerable to Information Disclosure. An improper authorization issue allows Guest project members to access trace log of jobs when it is enabled, resulting in disclosure of sensitive information.

References

gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1124.json

gitlab.com/gitlab-org/gitlab/-/issues/323552

hackerone.com/reports/1113405

security-tracker.debian.org/tracker/CVE-2022-1124

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

29.6%

JSON

Related for VERACODE:41482