CVE-2022-4289

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-4289
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4289.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-4289
Aliases
Downstream
Published
2023-03-09T00:00:00Z
Modified
2025-12-04T11:51:58.155030Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4289.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
b189ba070558de141d90142340de25bd3edcbefc
Fixed
d7f0ac7432bb9ab3f10b7025dc5f9d5b3fe8c76e
Database specific 
{
    "versions": [
        {
            "introduced": "15.3"
        },
        {
            "fixed": "15.7.8"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1d89c23c9f904e710e6e4ebdbc5bdd39cbb83717
Fixed
089019df22f87ccb9fff3ff3fe710f70f77084d3
Database specific 
{
    "versions": [
        {
            "introduced": "15.8"
        },
        {
            "fixed": "15.8.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
b107c0bae0871a67dee31ad8e52550d32c4afb66
Fixed
d80458522dd70245b7e0b9f1297f1dd227ebc10a
Database specific 
{
    "versions": [
        {
            "introduced": "15.9"
        },
        {
            "fixed": "15.9.2"
        }
    ]
}

Affected versions

v15.*

v15.8.0-ee
v15.8.1-ee
v15.8.2-ee
v15.8.3-ee
v15.9.0-ee
v15.9.1-ee