CVE-2022-3291 - Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache

Back Back to CVE browser

MEDIUM

Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache

Published Oct 17, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.80%

Description

Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache

Affected products

Vendor GitLab Product GitLab Default
n/a
- Version
  >=14.9, <15.2.5
  Status
  affected
  Constraints
  -
- Version
  >=15.3, <15.3.4
  Status
  affected
  Constraints
  -
- Version
  >=15.4, <15.4.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

n/a

Version	Status	Constraints
>=14.9, <15.2.5	affected	-
>=15.3, <15.3.4	affected	-
>=15.4, <15.4.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (2)

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3291.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/354299
Broken LinkVendor Advisory

Link	Providers	Tags
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3291.json		Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/354299		Broken LinkVendor Advisory