CVE-2022-2307
Summary
| CVE | CVE-2022-2307 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-08-05 16:15:00 UTC |
| Updated | 2022-08-11 15:02:00 UTC |
| Description | A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited. |
Risk And Classification
Problem Types: CWE-459
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Not Found | MISC | gitlab.com | |
| 2022/CVE-2022-2307.json · master · GitLab.org / cves · GitLab | CONFIRM | gitlab.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: This vulnerability has been discovered by the JiHu team
Legacy QID Mappings
- 690905 Free Berkeley Software Distribution (FreeBSD) Security Update for gitlab (4c26f668-0fd2-11ed-a83d-001b217b3468)