CVE-2022-0735

—

CVSS 3.1

9.8 critical

EPSS

13%p96

Published

Mar 28, 2022 (Mar 28, 2022)

Modified

Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.

Vendors: gitlab
Products: gitlab
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (13.2%)

In the news1 stories

New Security Vulnerability Affects Thousands of Self

The Hacker NewsMar 4, 17:27 UTC · Mar 4, 2022Vulnerability CVE-2021-4191 CVE-2022-0735