CVE-2022-0124

MEDIUM 4.3CVE-2022-0124 · Published 18/01/2022 · updated 17/06/2026

In short

CVE-2022-0124 is a MEDIUM (CVSS 4.3) vulnerability affecting gitlab (gitlab).
Chance of exploitation in the next 30 days (EPSS): 0.97%, higher than 62.2% of all vulnerabilities.
Fix: update to 14.5.3, 14.6.1, 14.4.5 or later.

Package	Affected versions	Patched versions
gitlab gitlab	`≥ 14.5.0, < 14.5.3≥ 14.6.0, < 14.6.1< 14.4.5`	`14.5.314.6.114.4.5`

Description

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack.

References

gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0124.json · Third Party Advisory
gitlab.com/gitlab-org/gitlab/-/issues/340176 · Broken Link
hackerone.com/reports/1310778 · Permissions Required

More vulnerabilities in gitlab

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

gitlab

≥ 14.5.0, < 14.5.3≥ 14.6.0, < 14.6.1< 14.4.5

14.5.314.6.114.4.5

More vulnerabilities in gitlab

See all →