← Back

CVE-2022-2428

nvd nist
Published: Oct 17, 2022Modified: May 13, 2025

JSON object

Loading...
7.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Exploitability: 2.1 / Impact: 5.2
Source: NVD

Description

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
Before 15.1.6
Gitlab
From 15.2 to 15.2.4
Gitlab
From 15.3 to 15.3.2
Gitlab
Before 15.1.6
Gitlab
From 15.2 to 15.2.4
Gitlab
From 15.3 to 15.3.2

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (7)

Source: cve@gitlab.com
Third Party Advisory
Source: cve@gitlab.com
Third Party Advisory
Source: cve@gitlab.com
Permissions RequiredThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions RequiredThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party Advisory

Timeline

No history available yet.