CVE-2022-4255

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=13.7, <15.4.6; >=15.5, <15.5.5; >=15.6, <15.6.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4255.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/373819Issue Tracking, Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4255.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/373819Issue Tracking, Vendor Advisory

Timeline

Published: Jan 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-42564.8The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high CVE-2022-42579.8A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the CVE-2022-42587.8In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via CVE-2022-42598.8Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an authe CVE-2022-42604.8The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-42616.5Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could a CVE-2022-42628.8Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2022-42644.3Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuratio CVE-2022-42658.8The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the p CVE-2022-42666.5The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to mak CVE-2022-42676.1The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, CVE-2022-42687.2The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL