MEDIUM

CVE-2021-22241

Gitlab GitLab 2021-08-05 CVSS v3.1

CVSS

5.4

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name.

Summary dbcve.org

A stored cross-site scripting (XSS) vulnerability in GitLab CE/EE versions 14.0 and later allows attackers to inject malicious JavaScript via a specifically crafted default branch name. When other users view the repository, the injected script executes in their browsers, potentially enabling session hijacking or data theft.

Mitigation

Update GitLab to the patched version released after this CVE, or implement input validation/sanitization for branch names to reject script-containing payloads.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.99%

Probability of exploitation in next 30 days

61th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22241.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/336460 Broken Link https://hackerone.com/reports/1256777 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE