VULNERABILITY INTELLIGENCE

CVE-2022-3325

CVSS score2.7 LOW

EPSS probability0.51%

CISA KEVNot currently listed

Published2022-10-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Description

Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user.

Weakness classification

nvd@nist.gov: NVD-CWE-Other
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284

Primary references

cve@gitlab.com — Vendor Advisory
cve@gitlab.com — Broken Link, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Broken Link, Vendor Advisory