CVE-2022-2497

CVE-2022-2497 is a medium-severity vulnerability affecting GitLab CE/EE versions 12.6 through 15.0.4, 15.1 through 15.1.3, and 15.2.0. A malicious developer can exfiltrate an integration's access token by manipulating the integration URL to redirect authenticated requests to an attacker-controlled server. This allows for potential compromise of sensitive credentials. The vulnerability has a CVSS score of 6.4 (Medium), indicating it can be exploited over the network with low attack complexity and requires low privileges. Successful exploitation could lead to low confidentiality and integrity impacts, as access tokens could be stolen and potentially misused. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei. The vulnerability has received minimal community discussion and media coverage, suggesting it is not widely known or actively targeted.