CVE-2022-3820
Assigner: GitLab
Published: 2023-01-24T00:00:00
State: PUBLISHED
descriptions: value: An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.
affected: vendor: GitLab
product: GitLab
versions: version: >=15.4, <15.4.6
status: affected
version: >=15.5, <15.5.5
status: affected
version: >=15.6, <15.6.1
status: affected
credits: value: This vulnerability has been discovered internally by the GitLab team.
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
problemTypes: descriptions: type: text
description: Improper access control in GitLab