CVE-2022-3513

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-351319.0Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.CVE-2022-351328.8Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.CVE-2022-351336.1A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted paCVE-2022-351345.4Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.CVE-2022-351358.8Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.CVE-2022-351366.5Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.CVE-2022-351375.4DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.CVE-2022-35145.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before CVE-2022-351427.5An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.CVE-2022-351439.8Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.CVE-2022-351444.8Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2022-351479.8DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.