VYPR
← All advisories
Medium severity5.3NVD Advisory· Published May 11, 2022· Updated Jun 17, 2026

CVE-2022-1352

CVE-2022-1352

Description

Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • GitLab Inc./GitLab6 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 5 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=11.0.0,<14.8.6
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=11.0.0,<14.8.6
    • cpe:2.3:a:gitlab:gitlab:14.10.0:*:*:*:community:*:*:*
    • cpe:2.3:a:gitlab:gitlab:14.10.0:*:*:*:enterprise:*:*:*
    • (no CPE)range: 11.0 <= 14.8.6, 14.9 < 14.9.4, 14.10 < 14.10.1
    • (no CPE)range: >=11.0, <14.8.6
  • GitLab Inc./GitLab EE and CEllm-fuzzy
    Range: 11.0 <= 14.8.6, 14.9 < 14.9.4, 14.10 < 14.10.1
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 11.0.0, < 14.8.6

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.