CVE-2022-3375
Last modified
CVE-2022-3375 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible to disclose the branch names when attacker has a fork of a project that was switched to private.. EPSS estimates a 0.80% chance of exploitation in the next 30 days.
Description
An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible to disclose the branch names when attacker has a fork of a project that was switched to private.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 11.10.0, < 15.8.5 |
| Gitlab | Gitlab | >= 15.9.0, < 15.9.4 |
| Gitlab | Gitlab | 15.10.0 |
References
- https://hackerone.com/reports/1710533Permissions Required
- https://hackerone.com/reports/1710533Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3375?
How severe is CVE-2022-3375?
How do I fix CVE-2022-3375?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-33744Arm guests can cause Dom0 DoS via PV devices When mapping pa…4.7
- CVE-2022-33745insufficient TLB flush for x86 PV guests in shadow mode For …8.8
- CVE-2022-33746P2M pool freeing may take excessively long The P2M pool back…6.5
- CVE-2022-33747Arm: unbounded memory consumption for 2nd-level page tables …3.8
- CVE-2022-33748lock order inversion in transitive grant copy handling As pa…5.6
- CVE-2022-33749XAPI open file limit DoS It is possible for an unauthenticat…5.3
- CVE-2022-33750CA Automic Automation 12.2 and 12.3 contain an authenticatio…9.8
- CVE-2022-33751CA Automic Automation 12.2 and 12.3 contain an insecure memo…7.5
- CVE-2022-33752CA Automic Automation 12.2 and 12.3 contain an insufficient …9.8
- CVE-2022-33753CA Automic Automation 12.2 and 12.3 contain an insecure file…8.8
- CVE-2022-33754CA Automic Automation 12.2 and 12.3 contain an insufficient …9.8
- CVE-2022-33755CA Automic Automation 12.2 and 12.3 contain an insecure inpu…5.3
Are you affected by CVE-2022-3375?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST