CVE-2021-22227
Description
A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it
Summary dbcve.org
A reflected cross-site scripting (XSS) vulnerability in GitLab versions prior to 13.11.6, 13.12.6, and 14.0.2 allowed attackers to inject malicious scripts into URLs. When authenticated users clicked these crafted links, the script executed within their session context, enabling unauthorized actions on their behalf.
Mitigation
Upgrade GitLab to version 13.11.6, 13.12.6, 14.0.2 or later. As a reflected XSS, the primary defense is patching the vulnerable endpoint(s) to properly sanitize or encode user-supplied input before reflecting it in responses.