CVE-2022-3513: XSS
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3513?
CVE-2022-3513 is rated as a medium severity vulnerability due to the potential for reflected cross-site scripting (XSS) attacks.
How do I fix CVE-2022-3513?
To remediate CVE-2022-3513, upgrade GitLab to version 15.8.5 or later, 15.9.4 or later, or 15.10.1 or later.
Which versions of GitLab are affected by CVE-2022-3513?
CVE-2022-3513 affects GitLab versions from 12.8 to 15.8.4, from 15.9 to 15.9.3, and 15.10.0.
What type of attack does CVE-2022-3513 enable?
CVE-2022-3513 enables attackers to carry out reflected cross-site scripting (XSS) attacks on the client side.
Is CVE-2022-3513 present in both community and enterprise versions of GitLab?
Yes, CVE-2022-3513 affects both community and enterprise editions of GitLab across the specified versions.