MEDIUM

CVE-2021-22225

Gitlab GitLab 2021-07-07 CVSS v3.1

CVSS

5.4

Description

Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

Summary dbcve.org

A stored cross-site scripting (XSS) vulnerability exists in GitLab's markdown rendering engine due to insufficient input sanitization. Attackers can inject malicious JavaScript via specially-crafted markdown that gets stored in the system and executes when other users view the rendered content.

Mitigation

Upgrade GitLab to the patched version that implements proper sanitization of markdown input, or implement output encoding as a defense-in-depth measure at the presentation layer.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.56%

Probability of exploitation in next 30 days

45.1th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22225.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/331051 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE