CVE-2022-2230high

CVE-2022-2230: falha de alta gravidade em GitLab

Publicada em · Atualizada em

33Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 57%
probabilidade de exploração
57%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
GitLab · GitLab
CVEs relacionadas — GitLab

No mesmo produto, das mais perigosas para as menos.

CVE-2021-22205CRITICALCVE-2021-22205EPSS 99.7%KEVCVE-2023-7028CRITICALWeak Password Recovery Mechanism for Forgotten Password in GitLabEPSS 94.6%KEVCVE-2026-85706CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabEPSS 93.0%KEVCVE-2021-22175MEDIUMCVE-2021-22175EPSS 53.4%KEVCVE-2021-39935MEDIUMCVE-2021-39935EPSS 36.1%KEVCVE-2023-2442HIGHCVE-2023-2442EPSS 96.1%
Referências
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2230.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/364164https://hackerone.com/reports/1588732