CVE-2022-2907

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-2907
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2907.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-2907
Aliases
Downstream
Published
2023-01-17T00:00:00Z
Modified
2026-04-10T04:47:07.697218Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It was possible to read repository content by an unauthorised user if a project member used a crafted link.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2907.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
073a4ba8016203c9e48595afd3ddea430d9420a3
Fixed
e3fcea907325032eeaa732b45d404a26e6310018
Database specific 
{
    "versions": [
        {
            "introduced": "12.9"
        },
        {
            "fixed": "15.1.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
d836c22d87f6f0397b93cc72ce3af27a6dc02d93
Fixed
e04b0a6dd2a14f79ac08d66fea184314051a1669
Database specific 
{
    "versions": [
        {
            "introduced": "15.2"
        },
        {
            "fixed": "15.2.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
b189ba070558de141d90142340de25bd3edcbefc
Fixed
e2ffae9620a2f88ebff56d17b26046f292aef85a
Database specific 
{
    "versions": [
        {
            "introduced": "15.3"
        },
        {
            "fixed": "15.3.2"
        }
    ]
}

Affected versions

v15.*
v15.2.0-ee
v15.2.2-ee
v15.3.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2907.json"