2 lines
4.0 KiB
JSON
2 lines
4.0 KiB
JSON
{"affected":[{"affectedData":[{"product":"GitLab","vendor":"GitLab","versions":[{"status":"affected","version":">=13.11, <14.9.5"},{"status":"affected","version":">=14.10, <14.10.4"},{"status":"affected","version":">=15.0, <15.0.1"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"B5D8AC23-4760-4977-AE95-A8D879520110","versionEndExcluding":"14.9.5","versionStartIncluding":"13.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"4E6B5E02-4670-4E74-A3EA-DF81659861E1","versionEndExcluding":"14.10.4","versionStartIncluding":"14.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:15.0.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"E8953D9B-56DF-4AA2-BFDC-B28CF4F31CB5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues"},{"lang":"es","value":"Una vulnerabilidad de tipo almacenado en la integración de Jira en GitLab EE afectando a todas las versiones desde la 13.11 anteriores a 14.9.5, 14.10 anteriores a 14.10.4 y 15.0 anteriores a 15.0.1, permite a un atacante ejecutar código JavaScript arbitrario en GitLab en nombre de la víctima por medio de ediciones de Jira especialmente diseñadas"}],"id":"CVE-2022-1940","lastModified":"2026-06-17T04:23:23.520","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":3.5,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":6.8,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.8,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-06-06T17:15:10.803","references":[{"source":"cve@gitlab.com","tags":["Patch","Third Party Advisory"],"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1940.json"},{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/359142"},{"source":"cve@gitlab.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/1533976"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1940.json"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/359142"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"],"url":"https://hackerone.com/reports/1533976"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}
|