Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-1175US | medium6.1 | Exploit | ||
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allo… | ||||
02
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/166829/Gitlab-14.9-Cross-Site-Scripting.htmlADVISORY
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1175.jsonADVISORY
- https://gitlab.com/gitlab-org/gitlab/-/issues/353370WEB
- https://hackerone.com/reports/1481207ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2022-1175WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan