{"affected":[{"affectedData":[{"product":"GitLab","vendor":"GitLab","versions":[{"status":"affected","version":">=9.0, <15.1.6"},{"status":"affected","version":">=15.2, <15.2.4"},{"status":"affected","version":">=15.3, <15.3.2"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"5A9F96AE-0B08-4A0E-A60C-CCBA691A38CB","versionEndExcluding":"15.1.6","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"E729D58B-8660-41D2-B667-5D664CA4E92D","versionEndExcluding":"15.1.6","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"3D749C09-7157-4B87-9232-8E32F05C6655","versionEndExcluding":"15.2.4","versionStartIncluding":"15.2","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"B81CEDFB-EDCD-4298-8AEF-80C16422AE12","versionEndExcluding":"15.2.4","versionStartIncluding":"15.2","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"72FB7E61-B73F-4BBA-A1B4-FAFC9F351858","versionEndExcluding":"15.3.2","versionStartIncluding":"15.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side."},{"lang":"es","value":"Se ha detectado un problema de tipo cross-site scripting en GitLab CE/EE afectando a todas las versiones anteriores a 15.1.6, 15.2 a 15.2.4 y 15.3 anteriores a 15.3.2. Era posible explotar una vulnerabilidad en la configuración de la función de color de las etiquetas que podía conllevar a un ataque de tipo XSS almacenado que permitía a atacantes llevar a cabo acciones arbitrarias en nombre de las víctimas en el lado del cliente"}],"id":"CVE-2022-2865","lastModified":"2026-06-17T04:42:44.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.8,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-2865","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-14T13:56:48.463701Z","version":"2.0.3"}}]},"published":"2022-10-17T16:15:21.387","references":[{"source":"cve@gitlab.com","tags":["Third Party Advisory"],"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2865.json"},{"source":"cve@gitlab.com","tags":["Broken Link","Third Party Advisory"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/370873"},{"source":"cve@gitlab.com","tags":["Permissions Required","Third Party Advisory"],"url":"https://hackerone.com/reports/1665658"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2865.json"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/370873"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"],"url":"https://hackerone.com/reports/1665658"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}