{"id":"CVE-2022-3573","published":"2023-01-12T00:00:00Z","modified":"2025-04-08T15:15:38Z","title":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions…","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":[">=15.4, <15.5.7",">=15.6, <15.6.4",">=15.7, <15.7.2"]}],"description":{"text":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00606,"percentile":0.48911,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-01-15","exploitedFirstSeen":"2025-01-15","ransomware":false,"evidence":[{"url":"https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/","date":"2025-01-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Botnets Never Die: An Analysis of the Large Scale Botnet AIRASHI","url":"https://otx.alienvault.com/pulse/6789d11936177d86cf5816cb","created":"2025-01-17"},{"name":"Botnets Never Die: An Analysis of the Large Scale Botnet AIRASHI","url":"https://otx.alienvault.com/pulse/6788e84c6e49a46074e0b726","created":"2025-01-16"}],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/378216","tags":[]},{"url":"https://hackerone.com/reports/1730461","tags":[]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-42937","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42937","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-01-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-3573","provenance":"source"},{"date":"2025-01-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":49.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 652 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.78,"detail":"percentile 0.4891"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}