CVE-2022-2761
Description
An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don't have access to.
Summary dbcve.org
This is an information disclosure vulnerability in GitLab's Jira integration where an attacker can embed GitLab Flavored Markdown (GFM) references in a Jira issue. When the Jira issue is rendered, GitLab returns metadata (including resource names) for referenced items the attacker shouldn't have access to, allowing enumeration of protected resource names.
Mitigation
Upgrade GitLab to version 15.3.5, 15.4.4, 15.5.2 or later. This is a server-side patch that corrects how GFM references are processed in the Jira integration context.