Vulnerability Description
Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 10.7.0, < 14.10.5 |
Related Weaknesses (CWE)
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1983.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/363651Broken Link
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1983.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/363651Broken Link
FAQ
What is CVE-2022-1983?
CVE-2022-1983 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key ...
How severe is CVE-2022-1983?
CVE-2022-1983 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-1983?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.