CVE-2022-1983

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=10.7, <14.10.5; >=15.0, <15.0.4; >=15.1, <15.1.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1983.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/363651Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1983.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/363651Broken Link

Timeline

Published: Jul 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19847.8This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before versi CVE-2022-19856.1The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is d CVE-2022-19869.8OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.CVE-2022-19878.1Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.CVE-2022-19886.1Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.CVE-2022-19895.3All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthentic CVE-2022-19904.8The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege user CVE-2022-19914.8A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master Lis CVE-2022-19929.1Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.CVE-2022-19938.1Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.CVE-2022-19944.8The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing h CVE-2022-19954.8The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with adminis