CVE-2022-1417

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=8.12, <14.8.6; >=14.9, <14.9.4; >=14.10, <14.10.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1417.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/297282Broken Link
https://hackerone.com/reports/1075586Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1417.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/297282Broken Link
https://hackerone.com/reports/1075586Permissions Required, Third Party Advisory

Timeline

Published: May 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14186.1The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does no CVE-2022-14197.8The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created i CVE-2022-14205.5Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.CVE-2022-14214.3The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary CVE-2022-14226.5The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an CVE-2022-14238.8Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions CVE-2022-14246.5The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in us CVE-2022-14254.3The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message CVE-2022-14263.7An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.CVE-2022-14277.8Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if be CVE-2022-14284.3An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions sta CVE-2022-14297.5SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data