What’s Vulnerable › Vulnerabilities

CVE-2022-2501

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-05 · updated 2026-06-17
• Weakness: CWE-863

Description

An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP allow-listing and download artifacts. This attack only bypasses IP allow-listing, proper permissions are still required.

Affected products

• GitLab: from 12.0.0 before 15.0.5; from 15.1.0 before 15.1.4; 15.2 — fixed in 15.0.5, 15.1.4

How to fix

Upgrade to a fixed version: GitLab 15.0.5, 15.1.4. Check the vendor advisory for mitigations.

References

• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2501.json
• https://gitlab.com/gitlab-org/gitlab/-/issues/364822
• https://hackerone.com/reports/1591412
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2501.json
• https://gitlab.com/gitlab-org/gitlab/-/issues/364822
• https://hackerone.com/reports/1591412

Get alerted when CVE-2022-2501 or the next vulnerability affects your stack