CVE-2022-2500: XSS
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2500?
CVE-2022-2500 is classified as a moderate severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2022-2500?
To mitigate CVE-2022-2500, upgrade GitLab CE/EE to versions 15.0.5, 15.1.4, or 15.2.1 or later.
What versions of GitLab are affected by CVE-2022-2500?
CVE-2022-2500 affects all GitLab CE/EE versions before 15.0.5, 15.1 before 15.1.4, and 15.2 before 15.2.1.
What kind of attack does CVE-2022-2500 enable?
CVE-2022-2500 enables attackers to perform stored cross-site scripting (XSS) attacks via job error messages.
Is CVE-2022-2500 a client-side or server-side vulnerability?
CVE-2022-2500 is a client-side vulnerability allowing attackers to execute arbitrary actions on victims' browsers.