CVEvulnerability
CVE-2022-1416
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-05-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling
Affected configurations
• gitlab gitlab (>= 1.0.2 < 14.8.6)
• gitlab gitlab (>= 14.9.0 < 14.9.4)
• gitlab gitlab 14.10.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1416.json Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/342988 Exploit, Issue Tracking, Technical Description, Third Party Advisory
- https://hackerone.com/reports/1362405 Permissions Required, Third Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1416.json Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/342988 Exploit, Issue Tracking, Technical Description, Third Party Advisory
- https://hackerone.com/reports/1362405 Permissions Required, Third Party Advisory