Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2022-0427

Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitLab

Description

Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GitLab GitLab

  • >=14.5, <14.5.4affected
  • >=14.6, <14.6.4affected
  • >=14.7, <14.7.1affected

References