CVE-2022-3573

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-3573
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/378216 Broken Link
https://hackerone.com/reports/1730461 Permissions Required Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/378216 Broken Link
https://hackerone.com/reports/1730461 Permissions Required Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:abb:drive_composer:*:*:*:*:entry:*:*:*
cpe:2.3:a:abb:drive_composer:*:*:*:*:pro:*:*:*
History

21 Nov 2024, 07:19

Type Values Removed Values Added
References () https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json - Vendor Advisory () https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json - Vendor Advisory
References () https://gitlab.com/gitlab-org/gitlab/-/issues/378216 - Broken Link () https://gitlab.com/gitlab-org/gitlab/-/issues/378216 - Broken Link
References () https://hackerone.com/reports/1730461 - Permissions Required, Third Party Advisory () https://hackerone.com/reports/1730461 - Permissions Required, Third Party Advisory
Summary
  • (es) Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 15.4 anteriores a 15.5.7, todas las versiones desde 15.6 anteriores a 15.6.4, todas las versiones desde 15.7 anteriores a 15.7.2. Debido al filtrado inadecuado de los parámetros de consulta en la página de cambios de la wiki, un atacante puede ejecutar JavaScript arbitrario en las instancias autohospedadas que se ejecutan sin un CSP estricto.

22 Mar 2023, 16:19

Type Values Removed Values Added
New CVE
Information

Published : 2023-01-12 04:15

Updated : 2024-11-21 07:19

NVD link : CVE-2022-3573

Mitre link : CVE-2022-3573

CVE.ORG link : CVE-2022-3573

JSON object : View

Products Affected

abb

  • drive_composer

gitlab

  • gitlab
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')