Логотип exploitDog
bind:CVE-2022-1680
Консоль
Логотип exploitDog

exploitDog

bind:CVE-2022-1680

Количество 5

Количество 5

ubuntu логотип

CVE-2022-1680

около 3 лет назад

An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account.

CVSS3: 9.9
EPSS: Средний
nvd логотип

CVE-2022-1680

около 3 лет назад

An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account.

CVSS3: 9.9
EPSS: Средний
debian логотип

CVE-2022-1680

около 3 лет назад

An account takeover issue has been discovered in GitLab EE affecting a ...

CVSS3: 9.9
EPSS: Средний
github логотип

GHSA-whxf-7mv4-g5wm

около 3 лет назад

An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account.

CVSS3: 8.8
EPSS: Средний
fstec логотип

BDU:2022-03328

около 3 лет назад

Уязвимость функции SCIM (System of Cross-domain Identity Management) программной платформы на базе git для совместной работы над кодом GitLab, связанная с возможностью приглашения произвольных пользователей через свое имя пользователя и адрес электронной почты, позволяющая нарушителю выполнить захват учетных записей пользователей путем изменения адреса их электронной почты

CVSS3: 9.6
EPSS: Средний

Уязвимостей на страницу

Уязвимость
CVSS
EPSS
Опубликовано
ubuntu логотип
CVE-2022-1680

An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account.

CVSS3: 9.9
11%
Средний
около 3 лет назад
nvd логотип
CVE-2022-1680

An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account.

CVSS3: 9.9
11%
Средний
около 3 лет назад
debian логотип
CVE-2022-1680

An account takeover issue has been discovered in GitLab EE affecting a ...

CVSS3: 9.9
11%
Средний
около 3 лет назад
github логотип
GHSA-whxf-7mv4-g5wm

An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account.

CVSS3: 8.8
11%
Средний
около 3 лет назад
fstec логотип
BDU:2022-03328

Уязвимость функции SCIM (System of Cross-domain Identity Management) программной платформы на базе git для совместной работы над кодом GitLab, связанная с возможностью приглашения произвольных пользователей через свое имя пользователя и адрес электронной почты, позволяющая нарушителю выполнить захват учетных записей пользователей путем изменения адреса их электронной почты

CVSS3: 9.6
11%
Средний
около 3 лет назад

Уязвимостей на страницу