CVE-2022-0344

2022-03-2800:00:00

ubuntu.com

gitlab

security issue

private project paths disclosure

unauthorized users

system notes

issue

merge request

public project

cve-2022-0344

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

46.3%

JSON

An issue has been discovered in GitLab affecting all versions starting from
10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all
versions starting from 10.2 before 14.7.1. Private project paths can be
disclosed to unauthorized users via system notes when an Issue is closed
via a Merge Request and later moved to a public project