All vulnerabilities

Servers and applications

CVE-2022-2228

Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling from outside the allowed IP range

Severity
Medium 6.5
Published
1 Jul 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
14.10.5, 15.0.4
Sources
NVD

Affected software

SoftwareAffected versions
GitLabServers and applications · cpe:a:gitlab:gitlab
  • From 12.0.0 before 14.10.5
  • From 15.0.0 before 15.0.4
  • Version 15.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-2228
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-2228