VulnerableCode Package Details - pkg:alpm/archlinux/gitlab@15.2.0-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-34rk-z4t7-e3dx Aliases: CVE-2022-2417	Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-4wn1-yx2k-uubz Aliases: CVE-2022-2456	An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-871m-u9m5-rfbh Aliases: CVE-2022-2326	An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an unverified secondary email.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-9q2b-awjx-zfbs Aliases: CVE-2022-2095	An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint and name when that key has write permission. Note that GitLab never asks for nor stores the private key.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-aykn-1umu-dfbe Aliases: CVE-2022-2512	An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project members to read updates via TODOs.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-fjcu-kr99-t7c5 Aliases: CVE-2022-2500	A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-n269-qqrx-fbby Aliases: CVE-2022-2539	An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-q6u2-pmzd-p3gm Aliases: CVE-2022-2497	An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-vgmg-zhfa-5bg8 Aliases: CVE-2022-2534	An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-yk7r-4d7d-2baq Aliases: CVE-2022-2307	A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-zn6s-jek8-3bda Aliases: CVE-2022-2303	An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA.	15.2.1-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-34rk-z4t7-e3dx
Aliases:
CVE-2022-2417

Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.