CVE-2022-2527 : An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all

An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests.

Published 2022-10-17 16:15:21

Updated 2025-05-13 20:15:22

Source GitLab Inc.

View at NVD, CVE.org

Products affected by CVE-2022-2527

Gitlab » Gitlab » Community Edition
Versions from including (>=) 14.9.0 and before (<) 15.1.6
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 15.2 and before (<) 15.2.4
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 15.3 and before (<) 15.3.2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 15.3 and before (<) 15.3.2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 14.9.0 and before (<) 15.1.6
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 15.2 and before (<) 15.2.4
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-2527

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 32 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-2527

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N	2.1	5.2	GitLab Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: None
8.0	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	2.1	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-2527

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2022-2527

https://hackerone.com/reports/1647446

HackerOne
Permissions Required;Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/368676

Content injection via Incidents Timeline description (#368676) · Issues · GitLab.org / GitLab · GitLab
Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2527.json

2022/CVE-2022-2527.json · master · GitLab.org / cves · GitLab
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-2527

Products affected by CVE-2022-2527

Exploit prediction scoring system (EPSS) score for CVE-2022-2527

CVSS scores for CVE-2022-2527

CWE ids for CVE-2022-2527

References for CVE-2022-2527