CVE-2022-4167

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-4167
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-4167.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-4167
Aliases
Downstream
Published
2023-01-12T00:00:00Z
Modified
2026-03-13T07:31:05.208184Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4167.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
47f41a4a74f364c731aafd34a93bddb630f62230
Fixed
cf58d7f15063b90d57456039739fdd02b2fedad9
Database specific 
{
    "versions": [
        {
            "introduced": "13.11"
        },
        {
            "fixed": "15.5.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
07a0843ad18ecb422cdc61bf3c2ef0a9dc58a209
Fixed
996d1d78f253747ff19544431bb03c6caaa81141
Database specific 
{
    "versions": [
        {
            "introduced": "15.6"
        },
        {
            "fixed": "15.6.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
bbf6efd2bedaef0d5c2112998a2a34534cc740bb
Fixed
78771c4b9a08f2dfeb56eb685b5c36b8a725c57c
Database specific 
{
    "versions": [
        {
            "introduced": "15.7"
        },
        {
            "fixed": "15.7.2"
        }
    ]
}

Affected versions

v15.*
v15.6.0-ee
v15.6.1-ee
v15.6.2-ee
v15.6.3-ee
v15.7.0-ee
v15.7.1-ee

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-4167.json"