VULNERABILITY INTELLIGENCE

CVE-2022-3820

CVSS score6.5 MEDIUM

EPSS probability0.73%

CISA KEVNot currently listed

Published2023-01-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Description

An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.

Weakness classification

nvd@nist.gov: NVD-CWE-Other
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-290

Primary references

cve@gitlab.com — Vendor Advisory
cve@gitlab.com — Exploit, Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Vendor Advisory