CVE-2022-2761

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don't have access to.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

VendorProductVersions
GitLabGitLab>=13.9, <15.3.5; >=15.4, <15.4.4; >=15.5, <15.5.2

References

Timeline

Published
Nov 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-276108.1Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation ManCVE-2022-276118.1Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station bCVE-2022-276129.8Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4CVE-2022-276138.8Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV SCVE-2022-276147.5Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remCVE-2022-276158.1Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before CVE-2022-276167.2Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DisCVE-2022-276174.3Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar beforeCVE-2022-276186.5Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage AnalyzeCVE-2022-276195.9Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 CVE-2022-27626.5The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin uCVE-2022-276204.9Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server befo
CVE-2022-2761: Medium severity, CVSS 5.3 | Vulnix