MEDIUM

CVE-2021-22223

Gitlab GitLab 2021-07-06 CVSS v3.1

CVSS

6.1

Description

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link

Summary dbcve.org

A stored Cross-Site Scripting (XSS) vulnerability in GitLab's Feature Flag functionality allows attackers to inject malicious code into feature flag names. When other users view or interact with these crafted flag names (e.g., by clicking a link), the injected script executes and can perform PUT requests on behalf of the victim user, leading to unauthorized state changes.

Mitigation

Upgrade GitLab to the latest version receiving the security patch. If immediate upgrade is not possible, restrict Feature Flag creation/modification to trusted administrators only and monitor for suspicious flag names containing HTML/script content.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.95%

Probability of exploitation in next 30 days

59.7th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22223.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/293946 Broken Link https://hackerone.com/reports/1059557 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE