CVE-2022-3513

Deeper analysis

CVE-2022-3513 is a reflected cross-site scripting vulnerability (CWE-79) in GitLab. It affects all versions from 12.8 up to but not including 15.8.5, from 15.9 up to but not including 15.9.4, and from 15.10 up to but not including 15.10.1. A specially crafted payload can trigger client-side reflected XSS, enabling arbitrary actions on behalf of a victim when the instance is self-hosted and lacks a strict content security policy. The issue carries a CVSS 3.1 score of 6.1.

An unauthenticated attacker can deliver a malicious link or payload over the network that executes in a victim's browser upon interaction. Successful exploitation allows limited reading and modification of data within the victim's session on the affected GitLab instance, with the changed scope indicating impact beyond the vulnerable component itself.

Advisories note that the reflected XSS is blocked on self-hosted deployments that enforce a strict CSP. The EPSS score has remained near 0.27–0.28 with no material rise after disclosure.