CVE-2022-3573 — Vulnetix

CVE-2022-3573 PUBLISHED

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.

EPSS 1.25% · 79.7th percentile

Risk Scores

EPSS Score

1.25%

79.7th percentile

Affected Products

Vendor	Product	Versions
Bitnami	gitlab	15.4.0, 15.6.0, 15.7.0
Bitnami	gitlab	15.4.0, 15.6.0, 15.7.0

Exploit Intelligence

CIRCL seen: CVE-2022-3573 (circl-sighting)
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json (circl)
https://gitlab.com/gitlab-org/gitlab/-/issues/378216 (cve.org)
https://hackerone.com/reports/1730461 (bitnami)

Timeline

Jul 1, 2022 CVE Published
Jan 12, 2023 EPSS Score
Feb 22, 2023 EPSS Score
Apr 4, 2023 EPSS Score
May 14, 2023 EPSS Score
Jun 24, 2023 EPSS Score
Aug 4, 2023 EPSS Score
Sep 14, 2023 EPSS Score
Oct 25, 2023 EPSS Score
Jan 14, 2024 EPSS Score
Feb 24, 2024 EPSS Score
Apr 5, 2024 EPSS Score

References

Open in Interactive Console →