CVE-2022-2865

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=9.0, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2865.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/370873Broken Link, Third Party Advisory
https://hackerone.com/reports/1665658Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2865.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/370873Broken Link, Third Party Advisory
https://hackerone.com/reports/1665658Permissions Required, Third Party Advisory

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-286505.4In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI CVE-2022-286515.5In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields CVE-2022-286525.5~/.config/apport/settings parsing is vulnerable to "billion laughs" attack CVE-2022-286537.5Users can consume unlimited disk space in /var/crash CVE-2022-286545.5is_closing_session() allows users to fill up apport.log CVE-2022-286557.1is_closing_session() allows users to create arbitrary tcp dbus connections CVE-2022-286565.5is_closing_session() allows users to consume RAM in the Apport process CVE-2022-286577.8Apport does not disable python crash handler before entering chroot CVE-2022-286585.5Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing CVE-2022-28667.8FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files. If a valid user is tricke CVE-2022-286609.8The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used CVE-2022-286618.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.2). The affected application contains an out of bounds read p