{"id":"CVE-2022-3573","published":"2023-01-12T00:00:00Z","modified":"2025-04-08T15:15:38Z","title":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions…","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":[">=15.4, <15.5.7",">=15.6, <15.6.4",">=15.7, <15.7.2"]}],"description":{"text":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00606,"percentile":0.49018,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-01-15","exploitedFirstSeen":"2025-01-15","ransomware":false,"evidence":[{"url":"https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/","date":"2025-01-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/378216","tags":[]},{"url":"https://hackerone.com/reports/1730461","tags":[]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-42937","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42937","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-01-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-3573","provenance":"source"},{"date":"2025-01-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":48.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 655 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.8,"detail":"percentile 0.4902"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}