CVE-2022-0124

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
GitLab	GitLab	<14.4.5; >=14.5.0, <14.5.3; >=14.6.0, <14.6.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0124.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/340176Broken Link
https://hackerone.com/reports/1310778Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0124.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/340176Broken Link
https://hackerone.com/reports/1310778Permissions Required

Timeline

Published: Jan 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-01254.3An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.CVE-2022-01287.8vim is vulnerable to Out-of-bounds Read CVE-2022-01296.7Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic L CVE-2022-01308.1Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenti CVE-2022-01313.3Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key CVE-2022-01327.5peertube is vulnerable to Server-Side Request Forgery (SSRF)CVE-2022-01337.5peertube is vulnerable to Improper Access Control CVE-2022-01348.8The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers CVE-2022-01357.8An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a CVE-2022-01368.1A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF CVE-2022-01375.5A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.CVE-2022-01387.5MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5