CVE-2021-22224: CSRF
Published Jul 7, 2021
·Updated
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim
Affected Software
2 affected components
GitLab GitLab>=13.12.0<13.12.6
GitLab GitLab>=14.0.0<14.0.2
Event History
Jul 7, 2021
CVE Published
via MITRE·11:26 AM
Data Sourced
via MITRE·11:26 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22224?
CVE-2021-22224 is classified as a medium-severity vulnerability.
2
How do I fix CVE-2021-22224?
To fix CVE-2021-22224, upgrade GitLab to version 13.12.6 or 14.0.2 or later.
3
What impact does CVE-2021-22224 have on GitLab users?
CVE-2021-22224 allows attackers to perform cross-site request forgery attacks by executing mutations as the victim.
4
In which versions of GitLab is CVE-2021-22224 present?
CVE-2021-22224 affects GitLab versions 13.12.0 to 13.12.5 and 14.0.0 to 14.0.1.
5
Who can be affected by CVE-2021-22224?
Any user of the affected versions of GitLab who interacts with the GraphQL API can be at risk from CVE-2021-22224.