CVE-2022-1940

5.4 mediumEPSS 6.3%

A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 6.3% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-06-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1940.json
https://gitlab.com/gitlab-org/gitlab/-/issues/359142
https://hackerone.com/reports/1533976
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1940.json
https://gitlab.com/gitlab-org/gitlab/-/issues/359142

Check your stack JSON