{"api_version":"1","generated_at":"2026-07-23T23:42:12+00:00","cve":"CVE-2022-0371","urls":{"html":"https://cve.report/CVE-2022-0371","api":"https://cve.report/api/cve/CVE-2022-0371.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-0371","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-0371"},"summary":{"title":"CVE-2022-0371","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails even if a user set their email to private.","state":"PUBLIC","assigner":"cve@gitlab.com","published_at":"2022-03-28 19:15:00","updated_at":"2022-04-04 19:14:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0371.json","name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0371.json","refsource":"CONFIRM","tags":[],"title":"2022/CVE-2022-0371.json · master · GitLab.org / cves · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/350476","name":"https://gitlab.com/gitlab-org/gitlab/-/issues/350476","refsource":"MISC","tags":[],"title":"Not Found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0371","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0371","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"This vulnerability was found internally by a member of the GitLab team.","lang":""}],"nvd_cpes":[{"cve_year":"2022","cve_id":"371","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"371","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-0371","qid":"690787","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for gitlab (3507bfb3-85d5-11ec-8c9c-001b217b3468)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2022-0371","ASSIGNER":"cve@gitlab.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"GitLab","product":{"product_data":[{"product_name":"GitLab","version":{"version_data":[{"version_value":">=14.7, <14.7.1"},{"version_value":">=14.6, <14.6.4"},{"version_value":">=11.4, <14.5.4"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Information exposure in GitLab"}]}]},"references":{"reference_data":[{"name":"https://gitlab.com/gitlab-org/gitlab/-/issues/350476","url":"https://gitlab.com/gitlab-org/gitlab/-/issues/350476","refsource":"MISC"},{"name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0371.json","url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0371.json","refsource":"CONFIRM"}]},"description":{"description_data":[{"lang":"eng","value":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails even if a user set their email to private."}]},"impact":{"cvss":{"vectorString":"AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","version":"3.1","baseScore":4.2,"baseSeverity":"MEDIUM"}},"credit":[{"lang":"eng","value":"This vulnerability was found internally by a member of the GitLab team."}]},"nvd":{"publishedDate":"2022-03-28 19:15:00","lastModifiedDate":"2022-04-04 19:14:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"14.6","versionEndExcluding":"14.6.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"14.6","versionEndExcluding":"14.6.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"14.7","versionEndExcluding":"14.7.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"14.7","versionEndExcluding":"14.7.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"11.4","versionEndExcluding":"14.5.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"11.4","versionEndExcluding":"14.5.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"371","Ordinal":"227061","Title":"CVE-2022-0371","CVE":"CVE-2022-0371","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"371","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}