CVE-2022-1680
Last modified
CVE-2022-1680 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. EPSS estimates a 15.47% chance of exploitation in the next 30 days.
Description
An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 11.10.0, < 14.9.5 |
| Gitlab | Gitlab | >= 14.10.0, < 14.10.4 |
| Gitlab | Gitlab | 15.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1680?
How severe is CVE-2022-1680?
How do I fix CVE-2022-1680?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1673The WooCommerce Green Wallet Gateway WordPress plugin before…6.1
- CVE-2022-1674NULL Pointer Dereference in function vim_regexec_string at r…5.5
- CVE-2022-1676Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-1677In OpenShift Container Platform, a user with permissions to …6.3
- CVE-2022-1678An issue was discovered in the Linux Kernel from 4.18 to 4.1…7.5
- CVE-2022-1679A use-after-free flaw was found in the Linux kernel’s Athero…7.8
- CVE-2022-1681Authentication Bypass Using an Alternate Path or Channel in …7.2
- CVE-2022-1682Reflected Xss using url based payload in GitHub repository n…6.1
- CVE-2022-1683The amtyThumb WordPress plugin through 4.2.0 does not saniti…8.8
- CVE-2022-1684The Cube Slider WordPress plugin through 1.2 does not saniti…2.7
- CVE-2022-1685The Five Minute Webshop WordPress plugin through 1.3.2 does …4.9
- CVE-2022-1686The Five Minute Webshop WordPress plugin through 1.3.2 does …2.7
Are you affected by CVE-2022-1680?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST