CVE-2022-1190: XSS
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 14.9.2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1190?
CVE-2022-1190 has a medium severity level due to the risk of stored XSS attacks.
How do I fix CVE-2022-1190?
To fix CVE-2022-1190, upgrade GitLab CE/EE to version 14.7.7, 14.8.5, or 14.9.2 or later.
What versions are affected by CVE-2022-1190?
CVE-2022-1190 affects GitLab CE/EE versions from 8.3 up to, but not including, 14.7.7, 14.8 up to 14.8.5, and 14.9 up to 14.9.2.
What type of vulnerability is CVE-2022-1190?
CVE-2022-1190 is classified as a stored cross-site scripting (XSS) vulnerability.
Can CVE-2022-1190 affect any GitLab setup?
Yes, CVE-2022-1190 can affect any instance of GitLab CE/EE within the specified vulnerable versions.