CVE-2022-0344
Last modified
CVE-2022-0344 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project. EPSS estimates a 1.07% chance of exploitation in the next 30 days.
Description
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 10.0, < 14.5.4 |
| Gitlab | Gitlab | >= 14.6.0, < 14.6.4 |
| Gitlab | Gitlab | 14.7.0 |
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/37015Exploit, Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/724880Permissions Required, Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/37015Exploit, Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/724880Permissions Required, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-0344?
How severe is CVE-2022-0344?
How do I fix CVE-2022-0344?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-0337Inappropriate implementation in File System API in Google Ch…6.5
- CVE-2022-0338Insertion of Sensitive Information into Log File in Conda lo…4.3
- CVE-2022-0339Server-Side Request Forgery (SSRF) in Pypi calibreweb prior …9.8
- CVE-2022-0341Cross-site Scripting (XSS) - Stored in GitHub repository van…5.4
- CVE-2022-0342An authentication bypass vulnerability in the CGI program of…9.8
- CVE-2022-0343A local attacker, as a different local user, may be able to …7.8
- CVE-2022-0345The Customize WordPress Emails and Alerts WordPress plugin b…4.3
- CVE-2022-0346The XML Sitemap Generator for Google WordPress plugin before…6.1
- CVE-2022-0347The LoginPress | Custom Login Page Customizer WordPress plug…6.1
- CVE-2022-0348Cross-site Scripting (XSS) - Stored in Packagist pimcore/pim…5.4
- CVE-2022-0349The NotificationX WordPress plugin before 2.3.9 does not san…9.8
- CVE-2022-0350Cross-site Scripting (XSS) - Stored in GitHub repository van…5.4
Are you affected by CVE-2022-0344?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST