CVE-2022-2230: 
GitLab vulnerability analysis and mitigation

CVE-2022-2230 is a Stored Cross-Site Scripting (XSS) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. The vulnerability was discovered in the project settings page and was reported through GitLab's HackerOne bug bounty program by researcher yvvdwf (GitLab Release).

The vulnerability exists in the deployment key rendering function where user-controlled input (deployment key title) is not properly sanitized before being rendered in the HTML content. The vulnerability bypasses Content Security Policy (CSP) protections through jQuery rendering, allowing execution of arbitrary JavaScript code. The severity is rated as high with a CVSS score of 8.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) (GitLab Release).

The vulnerability allows attackers to execute arbitrary JavaScript code in GitLab on a victim's behalf. This can lead to performing unauthorized API requests to access private resources and other malicious actions within the context of the victim's session (GitLab Issue).

The vulnerability has been patched in GitLab versions 14.10.5, 15.0.4, and 15.1.1. Users are strongly recommended to upgrade to these or later versions immediately. GitLab.com has already been updated with the patched version (GitLab Release).