VYPR
← All advisories
High severity7.3NVD Advisory· Published Nov 2, 2022· Updated Jun 17, 2026

CVE-2022-2904

CVE-2022-2904

Description

A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 It was possible to exploit a vulnerability in the external status checks feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • GitLab Inc./GitLab6 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 5 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=15.2,<15.2.5
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=15.2,<=15.2.5
    • cpe:2.3:a:gitlab:gitlab:15.4:*:*:*:community:*:*:*
    • cpe:2.3:a:gitlab:gitlab:15.4:*:*:*:enterprise:*:*:*
    • (no CPE)range: starting from 15.2 before 15.2.5, starting from 15.3 before 15.3.4, starting from 15.4 before 15.4.1
    • (no CPE)range: >=15.4, <15.4.1
  • GitLab Inc./GitLab EE and CEllm-fuzzy
    Range: starting from 15.2 before 15.2.5, starting from 15.3 before 15.3.4, starting from 15.4 before 15.4.1
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 15.2.0, < 15.2.5

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.