CVE-2022-1948

An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details.

Score

CVSS 3.1 8.7 High

Status

Modified - cve@gitlab.com

Published

2022-07-28

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Gitlab (Gitlab)

References

• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1948.json
• https://gitlab.com/gitlab-org/security/gitlab/-/issues/673
• https://hackerone.com/reports/1578400