CVE-2022-1510

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=13.9, <14.8.6; >=14.9, <14.9.4; >=14.10, <14.10.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1510.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/343276Broken Link
https://hackerone.com/reports/1353058Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1510.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/343276Broken Link
https://hackerone.com/reports/1353058Permissions Required, Third Party Advisory

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-15116.5Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.CVE-2022-15124.8The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users t CVE-2022-15138.8A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specia CVE-2022-15145.4Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scriptin CVE-2022-15155.5A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially CVE-2022-15165.5A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user t CVE-2022-15179.8LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, whi CVE-2022-15189.8LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.CVE-2022-15199.8LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including CVE-2022-15204.3When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may sho CVE-2022-15219.1LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive CVE-2022-15225.3The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization