CVE-2022-1944

When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.4 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
GitLabCNA
5.4 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 6%
VendorProductVersion
gitlabgitlab
11.3.0 ≤
𝑥
< 14.9.5
gitlabgitlab
11.3.0 ≤
𝑥
< 14.9.5
gitlabgitlab
14.10.0 ≤
𝑥
< 14.10.4
gitlabgitlab
14.10.0 ≤
𝑥
< 14.10.4
gitlabgitlab
15.0.0
gitlabgitlab
15.0.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gitlab
sid
16.8.4-1
fixed
Common Weakness Enumeration
References
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1944.json
https://gitlab.com/gitlab-org/gitlab/-/issues/349750
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1944.json
https://gitlab.com/gitlab-org/gitlab/-/issues/349750