VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jan 18, 2022· Updated Jun 17, 2026

CVE-2022-0172

CVE-2022-0172

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.

Affected products

6
  • GitLab Inc./GitLab4 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 3 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=13.2,<14.4.5
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=13.2,<14.4.5
    • (no CPE)range: >=12.3
    • (no CPE)range: >=14.6, <14.6.2
  • GitLab Inc./GitLab EE and CEllm-fuzzy
    Range: >=12.3
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 13.2.0, < 14.4.5

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.