CVE-2022-3573
Assigner: GitLab
Published: 2023-01-12T00:00:00
State: PUBLISHED
descriptions: value: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.
affected: vendor: GitLab
product: GitLab
versions: version: >=15.4, <15.5.7
status: affected
version: >=15.6, <15.6.4
status: affected
version: >=15.7, <15.7.2
status: affected
credits: value: Thanks [ryotak](https://hackerone.com/ryotak) for reporting this vulnerability through our HackerOne bug bounty program
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
problemTypes: descriptions: type: text
description: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab