CoreCVE
Back

MEDIUM

An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1

Published Apr 5, 2023

Description

An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner GitLab
Published Apr 5, 2023
Updated Feb 11, 2025
Reserved Oct 14, 2022
Link CVE-2022-3513

CISA Vulnrichment

Updated Feb 11, 2025

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2022-3513

Red Hat

No data

ENISA EUVD

Assigner GitLab
Published Apr 5, 2023
Updated Feb 11, 2025
Link EUVD-2022-42882

GitHub

No data