CVE-2022-3325

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-332507.5Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.CVE-2022-332517.5Transient DOS due to reachable assertion in Modem because of invalid network configuration.CVE-2022-332525.5Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.CVE-2022-332535.5Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames.CVE-2022-332547.5Transient DOS due to reachable assertion in Modem while processing SIB1 Message.CVE-2022-332556.5Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.CVE-2022-332569.8Memory corruption due to improper validation of array index in Multi-mode call processor.CVE-2022-332577.0Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.CVE-2022-332587.5Information disclosure due to buffer over-read in modem while reading configuration parameters.CVE-2022-332599.8Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.CVE-2022-33264.3Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.CVE-2022-332607.8Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.