What is CVE-2022-0167?

CVE-2022-0167 is a low-severity vulnerability in Gitlab, classified under Cross-site Scripting. CVSS score: 3.1/10. Published 2022-07-01.

How severe is CVE-2022-0167?

Low severity. CVSS v3 base score is 3.1 out of 10.

XSS in Gitlab

CVE-2022-0167

An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.007 (50.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N.

Affected products

Gitlab — versions >=14.0, <14.4.5, >=14.5.0, <14.5.3, >=14.6.0, <14.6.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@gitlab.com (Exploit, x_refsource_MISC, Vendor Advisory)
cve@gitlab.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2022-0167?: CVE-2022-0167 is a low-severity vulnerability in Gitlab, classified under Cross-site Scripting. CVSS score: 3.1/10. Published 2022-07-01.
How severe is CVE-2022-0167?: Low severity. CVSS v3 base score is 3.1 out of 10.