CVE-2022-1433

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-1433
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1433.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-1433
Aliases
Published
2022-05-11T14:27:44Z
Modified
2026-02-18T03:35:13.457497Z
Severity
  • 2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1433.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
19c719febd74b6edf549bf6a2c0e36bf8f176d56
Fixed
bba387c3128c9725b46e3b9dee0ac3809ca89c40
Database specific 
{
    "versions": [
        {
            "introduced": "14.4"
        },
        {
            "fixed": "14.8.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1fdefb34741e329ede520eba6c3038eb48bfa191
Fixed
58f08854bfbbc83c197c44d1143c253d6ddd0d4e
Database specific 
{
    "versions": [
        {
            "introduced": "14.9"
        },
        {
            "fixed": "14.9.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
ad109bc62af12e7a4e8da0a93255cf7d795705a0
Fixed
d849687d600c475e7a9a572c6f6e545aca8fa21e
Database specific 
{
    "versions": [
        {
            "introduced": "14.10"
        },
        {
            "fixed": "14.10.1"
        }
    ]
}

Affected versions

v14.*
v14.10.0-ee
v14.9.0-ee
v14.9.1-ee
v14.9.2-ee
v14.9.3-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1433.json"