CVE-2022-1175

Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.

Affected

GitLab

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 GITLAB

8.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

82.00% chance of exploitation in the next 30 days, 100th percentile

Published

2022-04-04

Updated

2024-08-02

Proof-of-concept exploits (1)

• Greenwolf/CVE-2022-11751★ · 2022-04-12

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50889

Security advisories

• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1175.json
• http://packetstormsecurity.com/files/166829/Gitlab-14.9-Cross-Site-Scripting.html
• https://hackerone.com/reports/1481207

References

• CVE Record
• NVD entry

Related

• CVE-2022-1162