CVE-2022-2228
Last modified
CVE-2022-2228 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling from outside the allowed IP range. EPSS estimates a 0.65% chance of exploitation in the next 30 days.
Description
Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling from outside the allowed IP range
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 12.0.0, < 14.10.5 |
| Gitlab | Gitlab | >= 15.0.0, < 15.0.4 |
| Gitlab | Gitlab | 15.1.0 |
References
- https://gitlab.com/gitlab-org/security/gitlab/-/issues/682Permissions Required, Vendor Advisory
- https://gitlab.com/gitlab-org/security/gitlab/-/issues/682Permissions Required, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-2228?
How severe is CVE-2022-2228?
How do I fix CVE-2022-2228?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-22274A Stack-based buffer overflow vulnerability in the SonicOS v…9.8
- CVE-2022-22275Improper Restriction of TCP Communication Channel in HTTP/S …7.5
- CVE-2022-22276A vulnerability in SonicOS SNMP service resulting exposure o…5.3
- CVE-2022-22277A vulnerability in SonicOS SNMP service resulting exposure o…5.3
- CVE-2022-22278A vulnerability in SonicOS CFS (Content filtering service) r…7.5
- CVE-2022-22279A post-authentication arbitrary file read vulnerability impa…4.9
- CVE-2022-22280Improper Neutralization of Special Elements used in an SQL C…9.8
- CVE-2022-22281A buffer overflow vulnerability in the SonicWall SSL-VPN Net…7.8
- CVE-2022-22282SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and e…9.8
- CVE-2022-22283Improper session management vulnerability in Samsung Health …3.3
- CVE-2022-22284Improper authentication vulnerability in Samsung Internet pr…5.5
- CVE-2022-22285A vulnerability using PendingIntent in Reminder prior to ver…7.1
Are you affected by CVE-2022-2228?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST