CVE-2022-4255

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-42564.8The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high CVE-2022-42579.8A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the CVE-2022-42587.8In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via CVE-2022-42598.8Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an autheCVE-2022-42604.8The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-42616.5Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could aCVE-2022-42628.8Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2022-42644.3Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuratioCVE-2022-42658.8The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the pCVE-2022-42666.5The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to makCVE-2022-42676.1The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, CVE-2022-42687.2The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL