{"api_version":"1","generated_at":"2026-07-23T10:28:32+00:00","cve":"CVE-2022-2533","urls":{"html":"https://cve.report/CVE-2022-2533","api":"https://cve.report/api/cve/CVE-2022-2533.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-2533","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-2533"},"summary":{"title":"CVE-2022-2533","description":"An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.","state":"PUBLIC","assigner":"cve@gitlab.com","published_at":"2022-10-17 16:15:00","updated_at":"2022-10-19 16:51:00"},"problem_types":["CWE-287"],"metrics":[],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/363863","name":"https://gitlab.com/gitlab-org/gitlab/-/issues/363863","refsource":"MISC","tags":[],"title":"Not Found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2533.json","name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2533.json","refsource":"CONFIRM","tags":[],"title":"2022/CVE-2022-2533.json · master · GitLab.org / cves · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2533","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2533","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"This vulnerability has been discovered internally by the GitLab team.","lang":""}],"nvd_cpes":[{"cve_year":"2022","cve_id":"2533","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"2533","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-2533","qid":"379228","title":"GitLab CE/EE Multiple Security Vulnerabilities"},{"cve":"CVE-2022-2533","qid":"379231","title":"GitLab Multiple Security Vulnerabilities (gitlab- 15.3.2, 15.2.4 and 15.1.6)"},{"cve":"CVE-2022-2533","qid":"690928","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for gitlab (e6b994e2-2891-11ed-9be7-454b1dd82c64)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2022-2533","ASSIGNER":"cve@gitlab.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"GitLab","product":{"product_data":[{"product_name":"GitLab","version":{"version_data":[{"version_value":">=12.10, <15.1.6"},{"version_value":">=15.2, <15.2.4"},{"version_value":">=15.3, <15.3.2"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper access control in GitLab"}]}]},"references":{"reference_data":[{"name":"https://gitlab.com/gitlab-org/gitlab/-/issues/363863","url":"https://gitlab.com/gitlab-org/gitlab/-/issues/363863","refsource":"MISC"},{"name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2533.json","url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2533.json","refsource":"CONFIRM"}]},"description":{"description_data":[{"lang":"eng","value":"An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location."}]},"impact":{"cvss":{"vectorString":"AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","version":"3.1","baseScore":6.4,"baseSeverity":"MEDIUM"}},"credit":[{"lang":"eng","value":"This vulnerability has been discovered internally by the GitLab team."}]},"nvd":{"publishedDate":"2022-10-17 16:15:00","lastModifiedDate":"2022-10-19 16:51:00","problem_types":["CWE-287"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.2}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"15.3","versionEndExcluding":"15.3.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"15.2","versionEndExcluding":"15.2.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"15.2","versionEndExcluding":"15.2.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"15.3","versionEndExcluding":"15.3.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"12.10","versionEndExcluding":"15.1.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"12.10","versionEndExcluding":"15.1.6","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}