p PatchFirst

CVE-2022-2498

CVE-2022-2498

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author.

CVSS 6.4 · Medium · EPSS 0.9%

Published
Updated

Stack: system

Affected products and versions

  • gitlab

    Versions
    • >=12.8, <15.0.5: Affected
    • >=15.1, <15.1.4: Affected
    • >=15.2, <15.2.1: Affected

    No fix published

  • gitlab Ubuntu:16.04:LTS

    Versions
    • 8.4.3+dfsg-9
    • 8.4.3+dfsg-12
    • 8.5.8+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →