CVE-2022-0984: Incorrect Authorization

April 29, 2022 (updated May 10, 2022)

Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.

References

bugzilla.redhat.com/show_bug.cgi?id=2064118
nvd.nist.gov/vuln/detail/CVE-2022-0984

Detect and mitigate CVE-2022-0984 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →