CVE-2022-1426

LOW Year: 2022
CVSS v3 Score
3.7
Low
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-287
View all →

Vulnerability Description

An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token.

Related Vulnerabilities

CVE-2017-1520

LOW
CVSS:3.7(Low)

IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830.

CWE-2872017

CVE-2018-16738

LOW
CVSS:3.7(Low)

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

CWE-2872018

CVE-2020-29668

LOW
CVSS:3.7(Low)

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

CWE-2872020

CVE-2021-20238

LOW
CVSS:3.7(Low)

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint (port 22623)...

CWE-2872021

CVE-2021-36368

LOW
CVSS:3.7(Low)

An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to ...

CWE-2872021

CVE-2022-22935

LOW
CVSS:3.7(Low)

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonat...

CWE-2872022