CVEvulnerability
CVE-2022-1175
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-04-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.
Affected configurations
• gitlab gitlab (>= 14.4.0 < 14.7.7)
• gitlab gitlab (>= 14.8.0 < 14.8.5)
• gitlab gitlab (>= 14.9.0 < 14.9.2)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/166829/Gitlab-14.9-Cross-Site-Scripting.html Third Party Advisory, VDB Entry
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1175.json Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/353370 Broken Link
- https://hackerone.com/reports/1481207 Permissions Required, Third Party Advisory
- http://packetstormsecurity.com/files/166829/Gitlab-14.9-Cross-Site-Scripting.html Third Party Advisory, VDB Entry
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1175.json Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/353370 Broken Link
- https://hackerone.com/reports/1481207 Permissions Required, Third Party Advisory