Medium · 4.3 CVE-2022-1545 EUVD-2022-24840GHSA-mc38-g3j7-hgww

It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.…

Published May 11, 2022 · Updated Aug 3, 2024 · Assigned by GitLab

Vendor: GitLab Product: GitLab Category: Web / CMS

Description

It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.

Affected products

Vendor	Product	Affected	Fixed
GitLab	GitLab	>=13.2, <14.8.6, >=14.9, <14.9.4, >=14.10, <14.10.1	—

References

https://gitlab.com/gitlab-org/gitlab/-/issues/351030
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1545.json