CVE-2022-0735 | An issue has been discovered in GitLab CE/EE affecting all v… | CVSS 10.0 CRITICAL

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.

Metadata

CVE ID: CVE-2022-0735
State: PUBLISHED
Assigner: GitLab
Reserved: 2022-02-23 00:00 UTC
Published: 2022-03-28 18:52 UTC
Last updated: 2024-08-02 23:40 UTC
Vendor / Product: GitLab / GitLab
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
GitLab	GitLab	—	>=14.8, <14.8.2, >=14.7, <14.7.4, >=12.10, <14.6.5

Weakness (CWE)

CWE	Source	Description
—	cna	Information exposure in GitLab

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)