CVEvulnerability
CVE-2022-1948
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-07-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details.
Affected configurations
• gitlab gitlab 15.0.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1948.json Vendor Advisory
- https://gitlab.com/gitlab-org/security/gitlab/-/issues/673 Permissions Required
- https://hackerone.com/reports/1578400 Permissions Required
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1948.json Vendor Advisory
- https://gitlab.com/gitlab-org/security/gitlab/-/issues/673 Permissions Required
- https://hackerone.com/reports/1578400 Permissions Required