CVE-2022-4331

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-4331
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-4331.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-4331
Aliases
Published
2023-03-09T00:00:00Z
Modified
2025-11-28T02:34:57.156295Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4331.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
31c24d2d8643ee22211ef544a4538c4420e96dc9
Fixed
d7f0ac7432bb9ab3f10b7025dc5f9d5b3fe8c76e
Database specific 
{
    "versions": [
        {
            "introduced": "15.1"
        },
        {
            "fixed": "15.7.8"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1d89c23c9f904e710e6e4ebdbc5bdd39cbb83717
Fixed
089019df22f87ccb9fff3ff3fe710f70f77084d3
Database specific 
{
    "versions": [
        {
            "introduced": "15.8"
        },
        {
            "fixed": "15.8.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
b107c0bae0871a67dee31ad8e52550d32c4afb66
Fixed
d80458522dd70245b7e0b9f1297f1dd227ebc10a
Database specific 
{
    "versions": [
        {
            "introduced": "15.9"
        },
        {
            "fixed": "15.9.2"
        }
    ]
}

Affected versions

v15.*
v15.8.0-ee
v15.8.1-ee
v15.8.2-ee
v15.8.3-ee
v15.9.0-ee
v15.9.1-ee

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-4331.json"