CVE-2022-2456
Assigner: GitLab
Published: 2022-08-05T15:10:42
State: PUBLISHED
affected: product: GitLab
vendor: GitLab
versions: status: affected
version: >=15.2, <15.2.1
status: affected
version: >=15.1, <15.1.4
status: affected
version: >=0.0, <15.0.5
credits: value: Thanks [suruli](https://hackerone.com/suruli) for reporting this vulnerability through our HackerOne bug bounty program.
descriptions: value: An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: description: Improper access control in GitLab
type: text