CVE-2022-2459

 

Published at: - 05-08-2022 06:15

Last modified: - 11-08-2022 05:39

Total changes: - 3

Description

An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

 

Verification logic

 

Reference

• https://gitlab.com/gitlab-org/gitlab/-/issues/336169
• https://hackerone.com/reports/1256967
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2459.json

 

Keywords

NVD

 

CVE-2022-2459

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures