2 lines
4.8 KiB
JSON
2 lines
4.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"GitLab","vendor":"GitLab","versions":[{"status":"affected","version":">=15.0.0, <15.0.1"},{"status":"affected","version":">=14.10.0, <14.10.4"},{"status":"affected","version":">=14.3, <14.9.5"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"51B378B5-906F-4CE2-9C91-53F9F9F5DAD3","versionEndExcluding":"14.9.5","versionStartIncluding":"14.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"2B8B95B6-6915-4DF1-ADBE-707119C9968F","versionEndExcluding":"14.9.5","versionStartIncluding":"14.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"5E69F4A1-5B3A-4FF5-95EC-62DCEB7DCE5F","versionEndExcluding":"14.10.4","versionStartIncluding":"14.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"4E6B5E02-4670-4E74-A3EA-DF81659861E1","versionEndExcluding":"14.10.4","versionStartIncluding":"14.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:15.0.0:*:*:*:community:*:*:*","matchCriteriaId":"00FDE831-EC28-4124-AC9F-A1C089D5BBFA","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:15.0.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"E8953D9B-56DF-4AA2-BFDC-B28CF4F31CB5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for malicious group maintainers to add new members to a project within their group, through the REST API, even after their group owner enabled a setting to prevent members from being added to projects within that group."},{"lang":"es","value":"Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de 14.3 anteriores a 14.9.5, todas las versiones a partir de 14.10 anteriores a 14.10.4, todas las versiones a partir de 15.0 anteriores a 15.0.1. Es posible a mantenedores de grupos maliciosos añadir nuevos miembros a un proyecto dentro de su grupo, mediante la API REST, incluso después de que el propietario de su grupo haya habilitado una configuración para evitar que se añadan miembros a los proyectos dentro de ese grupo"}],"id":"CVE-2022-1783","lastModified":"2026-06-17T04:23:06.300","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-06-06T17:15:10.543","references":[{"source":"cve@gitlab.com","tags":["Patch","Third Party Advisory"],"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1783.json"},{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/353121"},{"source":"cve@gitlab.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/1472109"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1783.json"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/353121"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"],"url":"https://hackerone.com/reports/1472109"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
|