Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-2235

Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to perform cross-site scripting when a victim clicks on a maliciously crafted ZenTao link

Published

2022-07-01T16:15:08.300

Last Modified

2024-11-21T07:00:35.750

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.7 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

6.8

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application gitlab gitlab < 14.10.5 Yes
Application gitlab gitlab < 15.0.4 Yes
Application gitlab gitlab 15.1.0 Yes
References