CVE-2022-2456

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-245629.8In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access t CVE-2022-245635.4In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_CVE-2022-245646.1Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject CVE-2022-245655.4Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability. Th CVE-2022-245665.4In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escape CVE-2022-245689.8Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.CVE-2022-24579.8A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Cons CVE-2022-245719.8Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection pay CVE-2022-245726.1Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit CVE-2022-245736.1A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to CVE-2022-245745.5GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().CVE-2022-245757.8GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.