CVE-2022-3413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-3413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-3413
Aliases
Downstream
Published
2022-11-09T00:00:00Z
Modified
2026-02-19T04:08:02.250864Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3413.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
490a8efda84a04e31ac41b882d95bb717c202437
Fixed
96db1338fc67d37c6d4f9e346d7847bda8605c76
Database specific 
{
    "versions": [
        {
            "introduced": "14.5"
        },
        {
            "fixed": "15.3.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
abbda55531f0a9d630eee1dcf2305ca499c94116
Fixed
1605b0f6c099e11e1335568bc4105de5c5d2a19c
Database specific 
{
    "versions": [
        {
            "introduced": "15.4"
        },
        {
            "fixed": "15.4.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
af0fced4dd2e767d361f2bdc0732be15ad2c1026
Fixed
767831e030c7b8b413b453d4730e92199ab7cfa3
Database specific 
{
    "versions": [
        {
            "introduced": "15.5"
        },
        {
            "fixed": "15.5.2"
        }
    ]
}

Affected versions

v15.*
v15.4.0-ee
v15.4.1-ee
v15.4.2-ee
v15.4.3-ee
v15.5.0-ee
v15.5.1-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3413.json"