CVE-2021-22183: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting with 11.8, identified as CVE-2021-22183. The vulnerability was a stored Cross-Site Scripting (XSS) in the epics page that could be exploited through user interactions. The issue was disclosed and patched in February 2021 (GitLab Release, NVD).

The vulnerability was classified as a stored XSS vulnerability with a CVSS v3.1 Base Score of 5.4 (Medium) and a CVSS v2.0 Base Score of 3.5 (Low). The attack vector was network-based (AV:N), requiring low attack complexity (AC:L) and low privileges (PR:L), with user interaction required (UI:R). The scope was changed (S:C), with low confidentiality and integrity impact (C:L, I:L) and no availability impact (A:N) (NVD).

The vulnerability could allow attackers to inject arbitrary JavaScript code into an epic's page using the Start date and Due date fields. This could potentially lead to the execution of malicious code in the context of other users' browsers who view the affected epic page (GitLab Release).

The vulnerability was exploitable through user interactions and required the attacker to have access to create or modify epics in a GitLab instance. The exploit was demonstrated to work on gitlab.com using Firefox, and on self-hosted GitLab instances without CSP using Safari, Chrome, or Firefox (GitLab Release).

The vulnerability was patched in GitLab versions 13.8.2, 13.7.6, and 13.6.6. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version as soon as possible (GitLab Release).