CVE-2022-3413

Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/374926	Broken Link Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

08 Aug 2023, 14:22

Type	Values Removed	Values Added
CWE	~~CWE-863~~	CWE-639

11 Nov 2022, 01:51

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
References	~~(MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/374926 -~~	(MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/374926 - Broken Link, Vendor Advisory
References	~~(CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json -~~	(CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json - Vendor Advisory
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
CWE		CWE-863

10 Nov 2022, 00:33

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-10 00:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-3413

Mitre link : CVE-2022-3413

CVE.ORG link : CVE-2022-3413

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2022-3413", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-11-10T00:15:20.737", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/374926", "tags": ["Broken Link", "Vendor Advisory"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above."}, {"lang": "es", "value": "La autorizaci\u00f3n incorrecta durante la visualizaci\u00f3n de eventos de auditor\u00eda en GitLab EE que afecta a todas las versiones desde 14.5 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2, permiti\u00f3 a los desarrolladores ver los eventos de auditor\u00eda del proyecto y a los desarrolladores o mantenedores ver los Eventos de Auditor\u00eda del grupo. Estos deber\u00edan haber estado restringidos a mantenedores de proyectos, propietarios de grupos y superiores."}], "lastModified": "2023-08-08T14:22:24.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "ED059E2E-B69C-4D8C-8FCD-966700E6DC7E", "versionEndExcluding": "15.3.5", "versionStartIncluding": "14.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "2FBFF5F6-6C42-4E64-8177-1BED65D38B00", "versionEndExcluding": "15.4.4", "versionStartIncluding": "15.4.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "CE5ABA53-66D4-4BDE-BE64-AB45EFDADE24", "versionEndExcluding": "15.5.2", "versionStartIncluding": "15.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}