CVE-2022-3572
published 2023-01-26CVE-2022-3572: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.07%
60.8th percentile
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 13.5.0 < 15.4.6 | 15.4.6 |
| gitlab | gitlab | >= 15.5.0 < 15.5.5 | 15.5.5 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_debian9.3CRITICAL
vendor_oracle5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2022-3572: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prio
vendor_gitlab·2023-01-26·CVSS 9.3
CVE-2022-3572 [CRITICAL] CWE-79 CVE-2022-3572: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prio
CVE-2022-3572: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
Oracle
Oracle Oracle Communications Risk Matrix: Policy (Package Installer for Python) — CVE-2021-3572
vendor_oracle·2022-07-15·CVSS 5.7
CVE-2021-3572 [MEDIUM] Oracle Oracle Communications Risk Matrix: Policy (Package Installer for Python) — CVE-2021-3572
Oracle Oracle Communications Risk Matrix: Policy (Package Installer for Python) vulnerability
CVE: CVE-2021-3572
CVSS: 5.7
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Communications Risk Matrix: OC-CNE (python-pip) — CVE-2021-3572
vendor_oracle·2022-04-15·CVSS 5.7
CVE-2021-3572 [MEDIUM] Oracle Oracle Communications Risk Matrix: OC-CNE (python-pip) — CVE-2021-3572
Oracle Oracle Communications Risk Matrix: OC-CNE (python-pip) vulnerability
CVE: CVE-2021-3572
CVSS: 5.7
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Debian
CVE-2022-3572: gitlab - A cross-site scripting issue has been discovered in GitLab CE/EE affecting all v...
vendor_debian·2022·CVSS 9.3
CVE-2022-3572 [CRITICAL] CVE-2022-3572: gitlab - A cross-site scripting issue has been discovered in GitLab CE/EE affecting all v...
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-6gf9-9hhg-h494: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13
ghsa_unreviewed·2023-01-26
CVE-2022-3572 [MEDIUM] CWE-79 GHSA-6gf9-9hhg-h494: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
OSV
CVE-2022-3572: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13
osv·2023-01-26·CVSS 6.1
CVE-2022-3572 [MEDIUM] CVE-2022-3572: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3572.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/378214https://hackerone.com/reports/1727985https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3572.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/378214https://hackerone.com/reports/1727985
2023-01-26
Published