MEDIUM

CVE-2022-1416

Gitlab GitLab 2022-05-19 CVSS v3.1

CVSS

5.4

Description

Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.74%

Probability of exploitation in next 30 days

53.3th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1416.json Third Party Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/342988 Exploit, Issue Tracking, Technical Description, Third Party Advisory https://hackerone.com/reports/1362405 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE