CVE-2022-3573 Cross-site scripting in GitLab
Attackers can execute arbitrary JavaScript on self-hosted GitLab instances lacking strict CSP via improper filtering in the wiki changes page.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-3573?
CVE-2022-3573 is a medium-severity cross-site scripting vulnerability in Gitlab Gitlab, published on 12 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.
Weakness: CWE-79
Which versions are affected by CVE-2022-3573?
1 open source package ship an affected version, including gitlab. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
gitlab Bitnami | From 15.4.0 | 15.5.7, 15.6.4, 15.7.2 |
Products include Abb Drive Composer, Gitlab Gitlab.
How do I fix CVE-2022-3573?
Upgrade gitlab to a fixed version for your release line: 15.5.7, 15.6.4 or 15.7.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-3573 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3573 exists.
Sources
Also known as BIT-gitlab-2022-3573, GHSA-jwcg-x754-2vpg, UBUNTU-CVE-2022-3573.