CVE-2022-0373

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=12.4, <14.5.4; >=14.6, <14.6.4; >=14.7, <14.7.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0373.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/349881Exploit, Issue Tracking, Third Party Advisory
https://hackerone.com/reports/1439254Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0373.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/349881Exploit, Issue Tracking, Third Party Advisory
https://hackerone.com/reports/1439254Permissions Required, Third Party Advisory

Timeline

Published: Apr 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03745.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03754.8Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03764.8The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting the CVE-2022-03774.3Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process th CVE-2022-03785.4Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-03795.4Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.CVE-2022-03806.1The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF CVE-2022-03816.1The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation CVE-2022-03825.5An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC CVE-2022-03837.2The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could CVE-2022-03844.3The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing CVE-2022-03856.1The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them ba