CVE-2022-3265
moderate-risk
Published 2022-11-09
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
Do I need to act?
!
17.7% chance of exploitation in next 30 days
EPSS score — higher than 82% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.3/10
High
NETWORK
/ HIGH complexity
Affected Vendors
References (6)
Permissions Required
https://hackerone.com/reports/1693150
Permissions Required
https://hackerone.com/reports/1693150
42
/ 100
moderate-risk
Severity
22/34 · High
Exploitability
13/34 · Low
Exposure
7/34 · Low