{"id":"CVE-2022-2230","published":"2022-07-01T15:55:13Z","modified":"2024-08-03T00:32:09Z","title":"A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from…","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":[">=14.4, <14.10.5",">=15.0, <15.0.4",">=15.1, <15.1.1"]}],"description":{"text":"A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf.","provenance":"source","from":"CVE.org"},"summary":{"text":"A Stored Cross-Site Scripting vulnerability in the project settings page of GitLab CE/EE allows an attacker to inject and persist script content that is executed in GitLab. The attack requires network access, high privileges, and user interaction, since the victim must be induced to act within the affected page.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:52Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.58219,"percentile":0.99092,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/364164","tags":["x_refsource_MISC"]},{"url":"https://hackerone.com/reports/1588732","tags":["x_refsource_MISC"]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2230.json","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-34510","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34510","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-07-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-2230","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9909"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}