CVE-2021-22238

MEDIUM severity · CVSS 6.8 · Cross-site scripting (XSS)

6.8CVSS MEDIUM

Summary

An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)1%

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Affected products we track (1)

GitLab

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22238.jsonAdvisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22238.jsonAdvisory
https://gitlab.com/gitlab-org/gitlab/-/issues/332420
https://hackerone.com/reports/1212067Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/332420
https://hackerone.com/reports/1212067Advisory