CVE-2022-2761 in Community Edition
Summary
by MITRE • 11/10/2022
An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don't have access to.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/27/2026
The vulnerability described in CVE-2022-2761 represents a significant information disclosure flaw within GitLab's markdown processing system that affects multiple versions of the GitLab Community and Enterprise editions. This issue stems from how GitLab handles Jira integration through its GitLab Flavored Markdown implementation, creating an avenue for unauthorized information exposure that violates fundamental security principles of access control and privilege enforcement. The vulnerability specifically manifests when users interact with Jira issue references within GitLab's markdown environment, allowing attackers to exploit the system's handling of these references to gain visibility into resources they should not be able to access.
The technical flaw resides in GitLab's insufficient validation and sanitization of markdown references when processing Jira issue integrations, creating a path where maliciously crafted markdown content can trigger unintended information disclosure behavior. This vulnerability operates at the application layer and specifically targets the markdown rendering engine's handling of external references, where the system fails to properly enforce access controls during the processing of Jira issue identifiers. The flaw enables attackers to construct specific markdown references that, when rendered, reveal information about resources such as project names, issue identifiers, or other sensitive metadata that should remain restricted to authorized users. This type of vulnerability maps directly to CWE-200, which addresses information exposure through improper access control mechanisms, and demonstrates the critical importance of input validation and access control enforcement in web applications.
The operational impact of this vulnerability extends beyond simple information leakage, as it can enable more sophisticated attacks by providing attackers with knowledge of system resources and structures that can be leveraged for further exploitation. An attacker could potentially use this information to map project hierarchies, identify sensitive repositories, or gather intelligence about the organization's Jira integration setup. This vulnerability particularly affects organizations that heavily rely on GitLab's Jira integration for project management and issue tracking, as it creates a vector for unauthorized discovery of internal project structures and resource naming conventions. The exposure of resource names can facilitate social engineering attacks, privilege escalation attempts, or provide attackers with additional reconnaissance data for targeting other system components.
Organizations should immediately implement mitigations including updating to the patched versions mentioned in the CVE advisory, specifically versions 15.3.5, 15.4.4, and 15.5.2, which contain the necessary code fixes to prevent the unauthorized disclosure of resource names. Additionally, administrators should review and restrict Jira integration permissions within their GitLab instances, ensuring that only authorized users can create or modify markdown content that references external systems. The mitigation strategy should also include implementing proper input validation for markdown content, particularly when processing external references, and monitoring for suspicious markdown patterns that might indicate attempts to exploit this vulnerability. This vulnerability aligns with ATT&CK technique T1213.002, which covers data from information repositories, and highlights the importance of maintaining proper access controls and input sanitization in collaborative development environments where external integrations are common.