CVE-2022-2235 — Cross-site Scripting in Gitlab

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 45.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedJul 1
Latest updateJul 2

Description

Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to perform cross-site scripting when a victim clicks on a maliciously crafted ZenTao link

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages5 packages

▶NVDgitlab/gitlab14.5.0 — 14.10.5+2
▶CVEListV5gitlab/gitlab>=14.5, <14.10.5, >=15.0, <15.0.4, >=15.1, <15.1.1+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-mxgw-4fpv-6f32: Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14↗2022-07-02
▶
OSV
CVE-2022-2235: Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14↗2022-07-01
▶

📋Vendor Advisories

2
GitLab
CVE-2022-2235: Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prio↗2022-07-01
▶
Debian
CVE-2022-2235: gitlab - Insufficient sanitization in GitLab EE's external issue tracker affecting all ve...↗2022
▶