CVE-2022-0735

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-0735
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0735.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-0735
Aliases
Downstream
Published
2022-03-28T18:52:59Z
Modified
2025-12-04T11:31:10.148873Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0735.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1d7d0b0a1db4c69533330ab29c6c0d3bdb17adba
Fixed
20a7fdf52c92b0b26e328d9f55803af6e4baebe4
Database specific 
{
    "versions": [
        {
            "introduced": "14.8"
        },
        {
            "fixed": "14.8.2"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
621e59848886e0dceec7a248ce6266450a7b5e21
Fixed
202c3007ccf93d8b338e10b49ef2c82e9d6f6bea
Database specific 
{
    "versions": [
        {
            "introduced": "14.7"
        },
        {
            "fixed": "14.7.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
58d798bed6228196b580ae8def5d5080e5a56c73
Fixed
2ef3e89df350d5f8ffc802c04c5f19864249d125
Database specific 
{
    "versions": [
        {
            "introduced": "12.10"
        },
        {
            "fixed": "14.6.5"
        }
    ]
}

Affected versions

v14.*

v14.7.0-ee
v14.7.1-ee
v14.7.2-ee
v14.7.3-ee
v14.8.0-ee
v14.8.1-ee

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0735.json"