What is CVE-2022-0124?

CVE-2022-0124 is a medium-severity vulnerability in Gitlab, classified under Improper Encoding or Escaping of Output. CVSS score: 4.3/10. Published 2022-01-18.

How severe is CVE-2022-0124?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Gitlab

CVE-2022-0124

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack.

EPSS: 0.010 (58.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Gitlab — versions <14.4.5, >=14.5.0, <14.5.3, >=14.6.0, <14.6.1

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

cve@gitlab.com (x_refsource_MISC, Broken Link)
cve@gitlab.com (Permissions Required, x_refsource_MISC)
cve@gitlab.com (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2022-0124?: CVE-2022-0124 is a medium-severity vulnerability in Gitlab, classified under Improper Encoding or Escaping of Output. CVSS score: 4.3/10. Published 2022-01-18.
How severe is CVE-2022-0124?: Medium severity. CVSS v3 base score is 4.3 out of 10.