Critical severity9.3NVD Advisory· Published Jan 26, 2023· Updated Jun 17, 2026
CVE-2022-3572
CVE-2022-3572
Description
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 4 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=13.5.0,<15.4.6
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=13.5.0,<15.4.6
- cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:enterprise:*:*:*
- (no CPE)range: >=13.5, <15.4.6
- Range: from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2
Patches
Vulnerability mechanics
References
3- gitlab.com/gitlab-org/gitlab/-/issues/378214nvdExploitVendor Advisory
- gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3572.jsonnvdVendor Advisory
- hackerone.com/reports/1727985nvdPermissions RequiredThird Party Advisory
News mentions
0No linked articles in our index yet.