CVE-2022-3573
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.
Summary dbcve.org
A stored Cross-Site Scripting (XSS) vulnerability in GitLab's wiki changes page allows attackers to inject malicious JavaScript via improperly filtered query parameters. The vulnerability is exploitable on self-hosted GitLab instances that do not enforce a strict Content Security Policy (CSP), enabling arbitrary script execution in the context of other users' sessions.
Mitigation
Upgrade GitLab to version 15.5.7, 15.6.4, 15.7.2 or later. As an additional defense-in-depth measure, ensure strict Content Security Policy headers are enabled on the GitLab instance.