Vulnerability · Published Aug 5, 2022 · Assigned by GitLab
CVE-2022-2499
Low 3.5
In plain English
A low-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.9%top 40.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab's Jira integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Jira issues.
Affected products (as reported)
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/360800 x_refsource_MISC
- https://hackerone.com/reports/1538068 x_refsource_MISC
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2499.json x_refsource_CONFIRM