CVE-2022-3793

2022-11-1000:00:00

ubuntu.com

gitlab ce/ee

authorization issue

unauthorized access

ci/cd configuration files

cve-2022-3793

unix

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

33.5%

JSON

An improper authorization issue in GitLab CE/EE affecting all versions from
14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows
an attacker to read variables set directly in a GitLab CI/CD configuration
file they don’t have access to.