CVE-2022-1148 Missing authorization in GitLab

Medium 5.3 Published 4 Apr 2022 Updated 2 Aug 2024

Attackers can steal user access tokens via malicious private GitLab Pages sites, enabling unauthorized access to other private repositories.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-1148?

CVE-2022-1148 is a medium-severity missing authorization vulnerability in Gitlab Gitlab, published on 4 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user's access token on an attacker-controlled private GitLab Pages website and reuse that token on the victim's other private websites

Weakness: CWE-565

Which versions are affected by CVE-2022-1148?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `11.5.0`	`14.7.7, 14.8.5, 14.9.2`

Products include Gitlab Gitlab.

How do I fix CVE-2022-1148?

Upgrade gitlab to a fixed version for your release line: 14.7.7, 14.8.5 or 14.9.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-1148 being exploited?

There is no known exploitation of CVE-2022-1148 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2022-1148, GHSA-5fmm-qcg5-xxr7, UBUNTU-CVE-2022-1148.