CVE-2022-2281

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows disclosure of release titles if group milestones are associated with any project releases.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=12.5, <14.10.5; >=15.0, <15.0.4; >=15.1, <15.1.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2281.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/271172Broken Link
https://hackerone.com/reports/1012659Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2281.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/271172Broken Link
https://hackerone.com/reports/1012659Permissions Required, Third Party Advisory

Timeline

Published: Jul 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-228109.8A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the adm CVE-2022-228118.1A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions, leading to the over CVE-2022-228126.1A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web s CVE-2022-228139.8A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active contr CVE-2022-228149.8The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation.CVE-2022-228156.5path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.CVE-2022-228166.5path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.CVE-2022-228179.8PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda CVE-2022-228186.1The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current conte CVE-2022-228197.8NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a CVE-2022-228205.5Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipie CVE-2022-228214.4NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admi