CVE-2021-22232

LOW

GitLab 9.5.0-13.11.5 - HTML Injection via Full Name Field

Title source: llm

HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE

Core 3

Core References

Broken Link x_refsource_misc

Permissions Required x_refsource_misc

Vendor Advisory x_refsource_confirm

CVSS v3 3.5

EPSS 0.0013

EPSS Percentile 31.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-74

Status published

Products (1)

gitlab/gitlab 9.5.0 - 13.11.6

Published Jul 06, 2021

Tracked Since Feb 18, 2026