CVE-2022-2527: XSS
An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2527?
CVE-2022-2527 is classified as a medium severity vulnerability.
How do I fix CVE-2022-2527?
To fix CVE-2022-2527, upgrade GitLab to version 15.1.6 or newer, 15.2.4 or newer, or 15.3.2 or newer as applicable.
Which versions are affected by CVE-2022-2527?
CVE-2022-2527 affects all GitLab CE and EE versions from 14.9 to 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2.
What type of attack does CVE-2022-2527 allow?
CVE-2022-2527 allows an authenticated attacker to inject arbitrary content into Incident Timelines.
Is there a workaround for CVE-2022-2527 if I cannot upgrade immediately?
There are no specific workarounds for CVE-2022-2527; upgrading to a patched version is recommended.