Riskcovery

CVE-2022-3031

State
Published
Severity
3.7 Low
Published
Oct 17, 2022
Updated
May 13, 2025
Reserved
Aug 29, 2022

Read the record on cve.org

Description

An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account.

Scores

CVSSScoreVectorSource
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NGitLab

Weaknesses

  • CWE-307 Improper Restriction of Excessive Authentication Attempts

Affected Products

ProductVersions
GitLabGitLab
  • >=15.3, <15.3.2Affected
  • >=15.2, <15.2.4Affected
  • >=0.0, <15.1.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.