CVE-2022-0740

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-07417.5Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables v CVE-2022-07427.5Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 pac CVE-2022-07434.6Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.CVE-2022-07456.5The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipi CVE-2022-07464.3Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.CVE-2022-07479.8The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement vi CVE-2022-07489.8The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any java CVE-2022-07499.8This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable i CVE-2022-07505.4The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the t CVE-2022-07518.8Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with CVE-2022-07526.1Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.CVE-2022-07536.1Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.