CVE-2022-0154
Description
An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.
Summary dbcve.org
GitLab versions 7.7 through 14.6.2 contain a Cross-Site Request Forgery (CSRF) vulnerability in the GitHub import functionality. The flaw allows an attacker to trick an authenticated GitLab user into importing the attacker's GitHub project into the victim's GitLab account by exploiting missing or improper anti-CSRF token validation on the import endpoint.
Mitigation
Upgrade to GitLab versions 14.4.5, 14.5.3, 14.6.2 or later. As an interim measure, disable GitHub import functionality or implement CSRF protection at the WAF level until patching is possible.