CVE-2022-3820 - Vulnerability Details - OpenCVE

An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Gitlab	Gitlab

Configuration 1 [-]

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:15.6.0::::community:::
	cpe:2.3:a:gitlab:gitlab:15.6.0::::enterprise:::

No data.

References

Link	Providers
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3820.json
https://gitlab.com/gitlab-org/gitlab/-/issues/378638

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2023-01-24T00:00:00

Updated: 2024-08-03T01:20:58.366Z

Reserved: 2022-11-02T00:00:00

Link: CVE-2022-3820

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-26T21:15:58.750

Modified: 2024-11-21T07:20:18.100

Link: CVE-2022-3820

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "99D007D3-5D61-4297-828B-B2956AF1FB06", "versionEndExcluding": "15.4.6", "versionStartIncluding": "15.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "89C5D451-E2F3-4EE1-BA54-830F572E1076", "versionEndExcluding": "15.4.6", "versionStartIncluding": "15.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "C2CF4BFC-D5A9-49F5-AC0E-A5978B8D8CFD", "versionEndExcluding": "15.5.5", "versionStartIncluding": "15.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C734804C-B835-493E-8A2B-556547368D9F", "versionEndExcluding": "15.5.5", "versionStartIncluding": "15.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:*", "matchCriteriaId": "B5CD27BD-9171-4958-9E31-FA35229B39E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "D1DA9696-F8DA-4C34-AB21-7DE509454B82", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab que afecta a todas las versiones desde la 15.4 anterior a la 15.4.4 y la 15.5 anterior a la 15.5.2. GitLab no estaba realizando la autenticaci\u00f3n correcta con algunos registros de paquetes cuando se configuraron las restricciones de direcci\u00f3n IP, lo que permiti\u00f3 que un atacante que ya estuviera en posesi\u00f3n de un token de implementaci\u00f3n v\u00e1lido lo usara indebidamente desde cualquier ubicaci\u00f3n."}], "id": "CVE-2022-3820", "lastModified": "2024-11-21T07:20:18.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-26T21:15:58.750", "references": [{"source": "cve@gitlab.com", "tags": ["Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3820.json"}, {"source": "cve@gitlab.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/378638"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3820.json"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/378638"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}