CVE-2022-2527
Description
An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests.
Summary dbcve.org
A stored cross-site scripting (XSS) vulnerability in GitLab's Incident Timelines feature allows authenticated attackers to inject arbitrary JavaScript content. When victims view the timeline, the injected code executes, enabling the attacker to perform arbitrary requests on behalf of the authenticated victim (likely via session hijacking or CSRF).
Mitigation
Upgrade GitLab to version 15.1.6, 15.2.4, 15.3.2 or later. If immediate upgrade is not feasible, consider restricting access to the Incident Timelines feature or implementing Content Security Policy headers as a temporary mitigation.