CVE-2022-0427: CSRF
Published Mar 28, 2022
·Updated
Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover
Affected Software
6 affected components
GitLab GitLab>=14.5<14.5.4
GitLab GitLab>=14.5<14.5.4
GitLab GitLab>=14.6<14.6.4
GitLab GitLab>=14.6<14.6.4
GitLab GitLab>=14.7<14.7.1
GitLab GitLab>=14.7<14.7.1
Event History
Mar 28, 2022
CVE Published
via MITRE·06:53 PM
Data Sourced
via MITRE·06:53 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-0427?
CVE-2022-0427 is considered a critical vulnerability due to its potential to allow account takeover through arbitrary HTTP POST requests.
2
How do I fix CVE-2022-0427?
To fix CVE-2022-0427, upgrade to GitLab versions 14.5.4, 14.6.4, or 14.7.1 or later.
3
What versions of GitLab are affected by CVE-2022-0427?
CVE-2022-0427 affects all GitLab CE/EE versions starting from 14.5 up to 14.7.1.
4
Can CVE-2022-0427 lead to data breaches?
Yes, CVE-2022-0427 can lead to data breaches if attackers successfully perform unauthorized actions on behalf of users.
5
Who is at risk from CVE-2022-0427?
Users of GitLab CE/EE versions 14.5 through 14.7.1 are at risk from CVE-2022-0427.