CVE-2021-22223: XSS
Published Jul 6, 2021
·Updated
Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link
Affected Software
6 affected components
GitLab GitLab>=13.9.0<13.11.6
GitLab GitLab>=13.9.0<13.11.6
GitLab GitLab>=13.12.0<13.12.6
GitLab GitLab>=13.12.0<13.12.6
GitLab GitLab>=14.0.0<14.0.2
GitLab GitLab>=14.0.0<14.0.2
Event History
Jul 6, 2021
CVE Published
via MITRE·09:50 PM
Data Sourced
via MITRE·09:50 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22223?
CVE-2021-22223 has a medium severity rating due to potential client-side code injection risks.
2
How do I fix CVE-2021-22223?
To fix CVE-2021-22223, update GitLab to version 13.11.6 or later, or 14.0.2 or later.
3
What versions of GitLab are affected by CVE-2021-22223?
CVE-2021-22223 affects GitLab versions from 13.9.0 up to 13.11.6, and 13.12.0 up to 13.12.6, as well as 14.0.0 up to 14.0.2.
4
What impact does CVE-2021-22223 have on users?
CVE-2021-22223 allows malicious users to perform unauthorized actions by exploiting specially crafted feature flag names.
5
Is CVE-2021-22223 a client-side or server-side vulnerability?
CVE-2021-22223 is a client-side vulnerability that allows for code injection through user interactions.