« Volver al listado

CVE-2022-3820

Estado: ModificadaMedia (6.5)—

An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gitlab — Gitlab

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-3820",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-3820",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-02T15:02:02.810173Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@gitlab.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@gitlab.com",
      "affectedData": [
        {
          "vendor": "GitLab",
          "product": "GitLab",
          "versions": [
            {
              "status": "affected",
              "version": ">=15.4, <15.4.6"
            },
            {
              "status": "affected",
              "version": ">=15.5, <15.5.5"
            },
            {
              "status": "affected",
              "version": ">=15.6, <15.6.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-01-26T21:15:58.750",
  "references": [
    {
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3820.json",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@gitlab.com"
    },
    {
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/378638",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@gitlab.com"
    },
    {
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3820.json",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/378638",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en GitLab que afecta a todas las versiones desde la 15.4 anterior a la 15.4.4 y la 15.5 anterior a la 15.5.2. GitLab no estaba realizando la autenticación correcta con algunos registros de paquetes cuando se configuraron las restricciones de dirección IP, lo que permitió que un atacante que ya estuviera en posesión de un token de implementación válido lo usara indebidamente desde cualquier ubicación."
    }
  ],
  "lastModified": "2026-06-17T05:00:21.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99D007D3-5D61-4297-828B-B2956AF1FB06",
              "versionEndExcluding": "15.4.6",
              "versionStartIncluding": "15.4.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89C5D451-E2F3-4EE1-BA54-830F572E1076",
              "versionEndExcluding": "15.4.6",
              "versionStartIncluding": "15.4.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2CF4BFC-D5A9-49F5-AC0E-A5978B8D8CFD",
              "versionEndExcluding": "15.5.5",
              "versionStartIncluding": "15.5.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C734804C-B835-493E-8A2B-556547368D9F",
              "versionEndExcluding": "15.5.5",
              "versionStartIncluding": "15.5.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5CD27BD-9171-4958-9E31-FA35229B39E7"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1DA9696-F8DA-4C34-AB21-7DE509454B82"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@gitlab.com"
}