CVE-2022-3265

Deeper analysis

A stored cross-site scripting vulnerability exists in GitLab CE/EE, affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. The flaw occurs in the labels color setting feature and is tracked as CWE-79, allowing an attacker to inject persistent scripts that execute in a victim's browser session.

An authenticated attacker with administrative privileges can exploit the issue by supplying a malicious label color value. Once stored, the payload triggers when other users view the affected labels, enabling the attacker to perform arbitrary actions on behalf of those victims at the client side. The vulnerability carries a CVSS 3.1 score of 7.3, reflecting the requirements for high privileges, user interaction, and a changed scope.

Advisories and patches published by GitLab direct administrators to upgrade to the fixed releases listed above. The referenced GitLab CVE records and issue tracker entries confirm that the remediation eliminates the input handling weakness in the labels feature.

EPSS scores reached a peak of 0.1770 with a current value of 0.1389, indicating moderate and relatively stable exploitation interest since disclosure.