MEDIUM

CVE-2021-22224

Gitlab GitLab 2021-07-07 CVSS v3.1

CVSS

6.5

Description

A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim

Summary dbcve.org

A cross-site request forgery (CSRF) vulnerability in GitLab's GraphQL API (versions 13.12 through before 13.12.6 and 14.0.2) allowed attackers to trick authenticated users into executing unauthorized GraphQL mutations. The API lacked proper CSRF token validation, enabling malicious requests to be processed as legitimate user actions.

Mitigation

Upgrade GitLab to version 13.12.6, 14.0.2, or later to obtain the patched version. Additionally, verify that GraphQL API endpoints require and properly validate CSRF tokens for all state-changing mutations.

Weakness (CWE)

CWE-352 Cross-Site Request Forgery (CSRF)

EPSS Score

0.89%

Probability of exploitation in next 30 days

57.9th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json Third Party Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/324397 Broken Link https://hackerone.com/reports/1122408 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE