CVE-2022-1190
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a…
High · published April 4, 2022
Patch now
High probability of exploitation
CVSS calls it high at 8.7. It sits in the 99.8th percentile for exploit probability.
What it is
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
The record
Technical detail
- CVSS v3.1
- 8.7 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.87946 · 99.8th percentile
- Published
- 2022-04-04T19:46Z
EPSS history
Timeline