AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2022-3870

MEDIUM · CVSS 5.3 EPSS 0.70%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2023-01-12 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2022-3870
Severity
MEDIUM
CVSS
5.3
EPSS
0.70%
GitLab

Original NVD Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.