CVE-2022-1175

Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions startin...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"14.4.0"},{"fixed":"14.7.7"},{"introduced":"14.8.0"},{"fixed":"14.8.5"},{"introduced":"14.9.0"},{"fixed":"14.9.2"}]}]

参照URL

advisory packetstormsecurity.com
advisory gitlab.com
advisory hackerone.com
web gitlab.com
web nvd.nist.gov