CVE-2022-0167: XSS

Q: What is the severity of CVE-2022-0167?

CVE-2022-0167 has been classified with a moderate severity level due to its impact on sensitive information exposure.

Q: How does CVE-2022-0167 affect GitLab?

CVE-2022-0167 affects GitLab by not disabling the Autocomplete attribute for fields related to sensitive information, potentially leading to unintentional data exposure.

Q: How can I fix CVE-2022-0167?

To mitigate CVE-2022-0167, users should upgrade to GitLab versions 14.4.5, 14.5.3, or 14.6.2 or later.

Q: Which versions of GitLab are affected by CVE-2022-0167?

CVE-2022-0167 affects GitLab versions from 14.0 to before 14.4.5, from 14.5.0 to before 14.5.3, and from 14.6.0 to before 14.6.2.

Q: Is CVE-2022-0167 specific to any GitLab edition?

CVE-2022-0167 affects both the Community and Enterprise editions of GitLab.

Published Jul 1, 2022

Updated

An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.

Affected Software

6 affected components

GitLab GitLab>=14.0.0<14.4.5

GitLab GitLab>=14.5.0<14.5.3

GitLab GitLab>=14.6.0<14.6.2

Event History

Jul 1, 2022

CVE Published

via MITRE·05:02 PM

Data Sourced

via MITRE·05:02 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-0167?

CVE-2022-0167 has been classified with a moderate severity level due to its impact on sensitive information exposure.

How does CVE-2022-0167 affect GitLab?

CVE-2022-0167 affects GitLab by not disabling the Autocomplete attribute for fields related to sensitive information, potentially leading to unintentional data exposure.

How can I fix CVE-2022-0167?