Medium severity6.1NVD Advisory· Published Apr 5, 2023· Updated Jun 17, 2026
CVE-2022-3513
CVE-2022-3513
Description
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 5 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=12.8.0,<15.8.5
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=12.8.0,<15.8.5
- cpe:2.3:a:gitlab:gitlab:15.10.0:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:15.10.0:*:*:*:enterprise:*:*:*
- (no CPE)range: 12.8 <= v < 15.8.5, 15.9 <= v < 15.9.4, 15.10 <= v < 15.10.1
- (no CPE)range: >=12.8, <15.8.5
Patches
Vulnerability mechanics
References
3- gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3513.jsonnvdVendor Advisory
- gitlab.com/gitlab-org/gitlab/-/issues/377970nvdBroken Link
- hackerone.com/reports/1728015nvdPermissions Required
News mentions
0No linked articles in our index yet.