MEDIUM

CVE-2021-22238

Gitlab GitLab 2021-08-20 CVSS v3.1

CVSS

5.4

Description

An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.

Summary dbcve.org

GitLab versions 13.3 and later contain a stored XSS vulnerability in the design feature within issues. Attackers can inject malicious JavaScript payloads into design attachments or metadata that persist on the server and execute when other users view the affected issue.

Mitigation

Upgrade GitLab to the patched version (consult GitLab's security release for exact version). Until then, restrict access to the design feature in affected projects and disable issue creation for untrusted users.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

71.79%

Probability of exploitation in next 30 days

99.4th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22238.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/332420 Broken Link https://hackerone.com/reports/1212067 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE