MEDIUM

CVE-2021-22171

Gitlab GitLab 2021-01-15 CVSS v3.1

CVSS

6.5

Description

Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link

Summary dbcve.org

GitLab Pages lacks proper validation of authentication parameters, allowing attackers to craft malicious links that can exfiltrate a victim's API token when clicked. The vulnerability stems from insufficient sanitization of URL parameters in the Pages authentication flow, enabling credential theft via cross-site request forgery-like attacks.

Mitigation

Upgrade GitLab to the latest version containing the security fix. If immediate patching is not possible, restrict Pages access and warn users against clicking untrusted links.

Weakness (CWE)

CWE-287 Improper Authentication

EPSS Score

1.33%

Probability of exploitation in next 30 days

69.8th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22171.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab-pages/-/issues/262 Broken Link https://hackerone.com/reports/718460 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE