MEDIUM

CVE-2022-1190

Gitlab GitLab 2022-04-04 CVSS v3.1

CVSS

5.4

Description

Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.

Summary dbcve.org

A stored cross-site scripting (XSS) vulnerability in GitLab CE/EE allows attackers to inject malicious scripts via multi-word milestone references in issue descriptions, comments, and other user-controllable fields. The application fails to properly sanitize milestone input before rendering it, enabling persistent script execution in the context of other users viewing the content.

Mitigation

Upgrade GitLab to version 14.7.7, 14.8.5, 14.9.2 or later. Until patched, restrict or moderate user contributions containing milestone references.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

87.36%

Probability of exploitation in next 30 days

99.7th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1190.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/352392 Broken Link https://hackerone.com/reports/1455036 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE