CVE-2022-1433
Description
An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute.
Summary dbcve.org
This is a secondary vulnerability in GitLab where missing Markdown cache invalidation allows malicious payloads from a previously fixed XSS vulnerability (CVE-2022-1175) to persist and execute. When CVE-2022-1175 was patched, the existing cached Markdown content containing the XSS payload was not cleared, allowing stored XSS to continue firing.
Mitigation
Clear the GitLab Markdown cache to invalidate any persisted XSS payloads from CVE-2022-1175, then upgrade to the fixed versions (14.8.6+, 14.9.4+, or 14.10.1+).