CVE-2021-22196: XSS
Published Apr 2, 2021
·Updated
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.
Affected Software
8 affected components
GitLab GitLab>=13.4.0
GitLab GitLab>=13.4.0
GitLab GitLab>=13.4.0<13.8.7
GitLab GitLab>=13.4.0<13.8.7
GitLab GitLab>=13.9.0<13.9.5
GitLab GitLab>=13.9.0<13.9.5
GitLab GitLab>=13.10.0<13.10.1
GitLab GitLab>=13.10.0<13.10.1
Event History
Apr 2, 2021
CVE Published
via MITRE·04:14 PM
Data Sourced
via MITRE·04:14 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22196?
CVE-2021-22196 has a medium severity due to its potential to allow stored cross-site scripting attacks.
2
How do I fix CVE-2021-22196?
To fix CVE-2021-22196, upgrade GitLab to version 13.8.7 or later for 13.4.x versions, or to version 13.9.5 or later for 13.9.x versions.
3
Which versions of GitLab are affected by CVE-2021-22196?
CVE-2021-22196 affects all GitLab CE/EE versions starting from 13.4 up to but not including 13.10.1.
4
What type of vulnerability is CVE-2021-22196?
CVE-2021-22196 is a stored cross-site scripting (XSS) vulnerability.
5
Can CVE-2021-22196 be exploited remotely?
Yes, CVE-2021-22196 can be exploited remotely through a crafted branch name affecting merge requests.