Cross-site Request Forgery (CSRF) Affecting gitlab package, versions <15.10.8+ds1-2
Threat Intelligence
EPSS
0.19% (58th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-GITLAB-2959836
- published 24 Jul 2022
- disclosed 28 Mar 2022
Introduced: 28 Mar 2022
CVE-2022-0427 Open this link in a new tabHow to fix?
Upgrade Debian:unstable
gitlab
to version 15.10.8+ds1-2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream gitlab
package and not the gitlab
package as distributed by Debian
.
See How to fix?
for Debian:unstable
relevant fixed versions and status.
Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover
CVSS Scores
version 3.1