CVE-2022-0172

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-01735.5radare2 is vulnerable to Out-of-bounds ReadCVE-2022-01744.3Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.CVE-2022-01755.5A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-bCVE-2022-01766.1The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it baCVE-2022-01785.4Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.CVE-2022-01795.4snipe-it is vulnerable to Missing AuthorizationCVE-2022-01808.8Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the autCVE-2022-01816.1Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitraCVE-2022-01825.4Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to injectCVE-2022-01834.6Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allowsCVE-2022-01844.3Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earlCVE-2022-01858.4A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux
CVE-2022-0172: Medium severity, CVSS 6.5 | Vulnix