CVE-2022-3572
Severity Score
6.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
Se descubrió un problema de cross site scripting en GitLab CE/EE que afecta a todas las versiones desde 13.5 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2. Fue posible explotar una vulnerabilidad al configurar la integración de Jira Connect, lo que podría conducir a un XSS reflejado que permitiera a los atacantes realizar acciones arbitrarias en nombre de las víctimas.
*Credits:
Thanks [ryotak](https://hackerone.com/ryotak) for reporting this vulnerability through our HackerOne bug bounty program
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-10-17 CVE Reserved
- 2023-01-24 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-08-16 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/378214 | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3572.json | 2023-02-01 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.5.0 < 15.4.6 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.5.0 < 15.4.6" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.5.0 < 15.4.6 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.5.0 < 15.4.6" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 15.5.0 < 15.5.5 Search vendor "Gitlab" for product "Gitlab" and version " >= 15.5.0 < 15.5.5" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 15.5.0 < 15.5.5 Search vendor "Gitlab" for product "Gitlab" and version " >= 15.5.0 < 15.5.5" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | 15.6.0 Search vendor "Gitlab" for product "Gitlab" and version "15.6.0" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | 15.6.0 Search vendor "Gitlab" for product "Gitlab" and version "15.6.0" | enterprise |
Affected
| ||||||