CVE-2022-1190: XSS
Published Apr 4, 2022
·Updated
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
Affected Software
6 affected components
GitLab GitLab>=8.3.0<14.7.7
GitLab GitLab>=8.3.0<14.7.7
GitLab GitLab>=14.8.0<14.8.5
GitLab GitLab>=14.8.0<14.8.5
GitLab GitLab>=14.9.0<14.9.2
GitLab GitLab>=14.9.0<14.9.2
Event History
Apr 4, 2022
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-1190?
CVE-2022-1190 has a medium severity level due to the risk of stored XSS attacks.
2
How do I fix CVE-2022-1190?
To fix CVE-2022-1190, upgrade GitLab CE/EE to version 14.7.7, 14.8.5, or 14.9.2 or later.
3
What versions are affected by CVE-2022-1190?
CVE-2022-1190 affects GitLab CE/EE versions from 8.3 up to, but not including, 14.7.7, 14.8 up to 14.8.5, and 14.9 up to 14.9.2.
4
What type of vulnerability is CVE-2022-1190?
CVE-2022-1190 is classified as a stored cross-site scripting (XSS) vulnerability.
5
Can CVE-2022-1190 affect any GitLab setup?
Yes, CVE-2022-1190 can affect any instance of GitLab CE/EE within the specified vulnerable versions.