5.4

CVE-2022-3573

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ GitLab SwEdition community Version >= 15.4.0 < 15.5.7
Gitlab ≫ GitLab SwEdition enterprise Version >= 15.4.0 < 15.5.7
Gitlab ≫ GitLab SwEdition community Version >= 15.6.0 < 15.6.4
Gitlab ≫ GitLab SwEdition enterprise Version >= 15.6.0 < 15.6.4
Gitlab ≫ GitLab SwEdition community Version >= 15.7.0 < 15.7.2
Gitlab ≫ GitLab SwEdition enterprise Version >= 15.7.0 < 15.7.2
Abb ≫ Drive Composer SwEdition entry Version <= 2.8
Abb ≫ Drive Composer SwEdition pro Version <= 2.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.433
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cve@gitlab.com 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/378216
Broken Link
https://hackerone.com/reports/1730461
Third Party Advisory
Permissions Required