CVE-2021-32735: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in GitLab CE/EE versions 13.11.6, 13.12.6, and 14.0.2, where HTML injection was possible via the full name field. The vulnerability was disclosed on July 2, 2021, and assigned identifier CVE-2021-32735. The issue affected multiple GitLab versions and allowed attackers to inject malicious HTML code through user input (GitLab Advisory).

The vulnerability stems from insufficient HTML escaping in GitLab's user interface where the full name field was not properly sanitized before being displayed. This allowed attackers to inject arbitrary HTML and JavaScript code that would be executed when other users viewed the affected content. The vulnerability received a CVSS score of 3.5, indicating moderate severity (CISA Bulletin).

The vulnerability could allow attackers to perform cross-site scripting attacks against other users viewing the malicious content. Successful exploitation could lead to session hijacking, credential theft, or other client-side attacks within the context of the GitLab application (GitLab Advisory).

The vulnerability required an attacker to have a valid GitLab account to exploit, as they needed to be able to modify their own full name field. Once the malicious content was injected, it would affect any other user who viewed the attacker's profile or content containing their full name (CISA Bulletin).

The vulnerability was patched in GitLab versions 13.11.6, 13.12.6, and 14.0.2. Users are advised to upgrade to these or later versions to protect against this vulnerability. The fix involved implementing proper HTML escaping for the full name field to prevent injection of malicious code (GitLab Advisory).