CVE-2022-4365

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.8 through 15.5.7 GitLab CE/EE versions 15.6 through 15.6.4 GitLab CE/EE versions 15.7 through 15.7.2

Description A malicious Maintainer can exploit an issue in GitLab CE/EE to leak the sentry token. This is achieved by changing the configured URL in the Sentry error tracking settings page.

Recommendations For GitLab CE/EE versions 11.8 through 15.5.7, update to version 15.5.7 or later. For GitLab CE/EE versions 15.6 through 15.6.4, update to version 15.6.4 or later. For GitLab CE/EE versions 15.7 through 15.7.2, update to version 15.7.2 or later. As a temporary workaround, consider restricting access to the Sentry error tracking settings page to prevent malicious Maintainers from changing the configured URL.