CVE-2022-1190
published 2022-04-04CVE-2022-1190: Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a…
PriorityP345medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
87.37%
99.7th percentile
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.8.0 < 14.8.5 | 14.8.5 |
| gitlab | gitlab | >= 14.9.0 < 14.9.2 | 14.9.2 |
| gitlab | gitlab | >= 8.3.0 < 14.7.7 | 14.7.7 |
| gitlab | gitlab_ce | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Stored XSS payload location: look for malicious multi-word milestone references (e.g., %"...") injected into GitLab issue descriptions, comments, or similar user-input fields ↗
- →Audit GitLab CE/EE instances running versions 8.3 through 14.7.6, 14.8.0–14.8.4, or 14.9.0–14.9.1 as vulnerable; prioritize review of stored content (issues, comments) on these versions for unsanitized milestone reference syntax ↗
- ·Vulnerability is scoped as 'local' by Debian security tracker; exploitation requires an authenticated user able to create/edit issues or comments on the target GitLab instance ↗
- ·Debian sid resolved the issue in package version 15.10.8+ds1-2; ensure patched GitLab versions (≥14.7.7, ≥14.8.5, ≥14.9.2) are deployed to remediate ↗
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.4MEDIUM
vendor_debian8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2022-1190: Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to ex
vendor_gitlab·2022-04-04·CVSS 8.7
CVE-2022-1190 [HIGH] CWE-79 CVE-2022-1190: Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to ex
CVE-2022-1190: Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
Debian
CVE-2022-1190: gitlab - Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14...
vendor_debian·2022·CVSS 8.7
CVE-2022-1190 [HIGH] CVE-2022-1190: gitlab - Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14...
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
ghsa·2022-11-16
CVE-2022-45379 [HIGH] CWE-326 Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the [SHA-1 hash](https://en.wikipedia.org/wiki/SHA-1) of the approved script. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest.
Script Security Plugin 1190.v65867a_a_47126 uses SHA-512 for new whole-script approvals. Previously approved scripts will have their SHA-1 based whole-script approval replaced with a corresponding SHA-512 whole-script approval when the script is next used.
Whole-script approval only stores the SHA-1 or SHA-512 hash, so it is not possible to migrate all previously approved scripts automatically on startup.
Administrators concerned about
GHSA
GHSA-6224-476v-jppq: Improper handling of user input in GitLab CE/EE versions 8
ghsa_unreviewed·2022-04-05
CVE-2022-1190 [MEDIUM] CWE-79 GHSA-6224-476v-jppq: Improper handling of user input in GitLab CE/EE versions 8
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
OSV
CVE-2022-1190: Improper handling of user input in GitLab CE/EE versions 8
osv·2022-04-04·CVSS 5.4
CVE-2022-1190 [MEDIUM] CVE-2022-1190: Improper handling of user input in GitLab CE/EE versions 8
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1190.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/352392https://hackerone.com/reports/1455036https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1190.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/352392https://hackerone.com/reports/1455036
2022-04-04
Published