CVE-2022-2531
Last modified
CVE-2022-2531 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerability.. EPSS estimates a 1.09% chance of exploitation in the next 30 days.
Description
An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 12.5.0, < 15.0.5 |
| Gitlab | Gitlab | >= 15.1.0, < 15.1.4 |
| Gitlab | Gitlab | 15.2 |
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/364252Broken Link, Vendor Advisory
- https://hackerone.com/reports/1566306Permissions Required, Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/364252Broken Link, Vendor Advisory
- https://hackerone.com/reports/1566306Permissions Required, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-2531?
How severe is CVE-2022-2531?
How do I fix CVE-2022-2531?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-25304All versions of package opcua; all versions of package async…7.5
- CVE-2022-25305The WP Statistics WordPress plugin is vulnerable to Cross-Si…6.1
- CVE-2022-25306The WP Statistics WordPress plugin is vulnerable to Cross-Si…6.1
- CVE-2022-25307The WP Statistics WordPress plugin is vulnerable to Cross-Si…6.1
- CVE-2022-25308A stack-based buffer overflow flaw was found in the Fribidi …7.8
- CVE-2022-25309A heap-based buffer overflow flaw was found in the Fribidi p…5.5
- CVE-2022-25310A segmentation fault (SEGV) flaw was found in the Fribidi pa…5.5
- CVE-2022-25311A vulnerability has been identified in SINEC NMS (All versio…7.3
- CVE-2022-25312An XML external entity (XXE) injection vulnerability was dis…9.1
- CVE-2022-25313In Expat (aka libexpat) before 2.4.5, an attacker can trigge…6.5
- CVE-2022-25314In Expat (aka libexpat) before 2.4.5, there is an integer ov…7.5
- CVE-2022-25315In Expat (aka libexpat) before 2.4.5, there is an integer ov…9.8
Are you affected by CVE-2022-2531?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST