CVE-2021-22196

MEDIUM

GitLab 13.4.0-13.8.6 - Stored Cross-Site Scripting via Merge Request Branch Name

Title source: llm

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.

References (3)

Core 3

Core References

Broken Link x_refsource_misc

https://gitlab.com/gitlab-org/gitlab/-/issues/254710

Permissions Required, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/977697

Vendor Advisory x_refsource_confirm

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22196.json

Scores

CVSS v3 6.3

EPSS 0.0019

EPSS Percentile 40.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

gitlab/gitlab 13.4.0 - 13.8.7 (2 CPE variants)

Published Apr 02, 2021

Tracked Since Feb 18, 2026