CVE-2022-2230

Deeper analysis

A stored cross-site scripting vulnerability exists in the project settings page of GitLab Community Edition and Enterprise Edition. It affects all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, and is tracked under CWE-79. The flaw permits an attacker to store arbitrary JavaScript that later executes in a victim's browser session.

An authenticated user with project settings privileges can inject the malicious payload, which then runs with the victim's permissions when the settings page is viewed. Successful exploitation can lead to theft of session tokens or other sensitive data and actions performed on the victim's behalf, consistent with the CVSS 8.1 rating reflecting high confidentiality and integrity impact across a changed scope.

References to GitLab's CVE repository, issue tracker, and the associated HackerOne report indicate that the issue is resolved by upgrading to the fixed releases listed in the advisory.

The EPSS score rose from a low starting value to a peak of 0.0659 on 2025-12-11 before receding to the current 0.0176, signaling that exploitation interest emerged after disclosure.