CVE-2022-3325

Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user.

CVSS v3.0 4.3 MEDIUM

4.3^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json	Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/360819	Broken Link Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/360819	Broken Link Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/360819	Broken Link Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

13 May 2025, 16:15

Type	Values Removed	Values Added
References	~~(MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/360819 - Broken Link, Vendor Advisory~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/360819 - Broken Link, Vendor Advisory
References	~~(CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json - Vendor Advisory~~	() https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json - Vendor Advisory

08 Aug 2023, 14:21

Type	Values Removed	Values Added
CWE	~~CWE-732~~	NVD-CWE-Other

Information

Published : 2022-10-17 16:15

Updated : 2025-05-13 16:15

NVD link : CVE-2022-3325

Mitre link : CVE-2022-3325

JSON object : View

Products Affected

gitlab

gitlab

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json", "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json", "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/360819", "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/360819", "tags": ["Broken Link", "Vendor Advisory"], "refsource": ""}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/360819", "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/360819", "tags": ["Broken Link", "Vendor Advisory"], "refsource": ""}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/360819", "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/360819", "tags": ["Broken Link", "Vendor Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-3325", "ASSIGNER": "cve@gitlab.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}}, "publishedDate": "2022-10-17T16:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "15.4.1", "versionStartIncluding": "15.4"}, {"cpe23Uri": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "15.3.4", "versionStartIncluding": "15.3"}, {"cpe23Uri": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "15.4.1", "versionStartIncluding": "15.4"}, {"cpe23Uri": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "15.3.4", "versionStartIncluding": "15.3"}, {"cpe23Uri": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "15.2.5", "versionStartIncluding": "12.8.0"}, {"cpe23Uri": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "15.2.5", "versionStartIncluding": "12.8.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-05-13T16:15Z"}