CVE-2021-22223

MEDIUM

GitLab 13.9.0-13.11.5 - Cross-Site Scripting via Feature Flag Name

Title source: llm
STIX 2.1

Description

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link

References (3)

Core 3
Core References
Permissions Required x_refsource_misc
https://hackerone.com/reports/1059557

Scores

CVSS v3 6.1
EPSS 0.0019
EPSS Percentile 39.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
gitlab/gitlab 13.9.0 - 13.11.6 (2 CPE variants)
Published Jul 06, 2021
Tracked Since Feb 18, 2026