CVE-2021-22232

Description

HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE

How to fix CVE-2021-22232

To remediate CVE-2021-22232, upgrade the affected package to a fixed version below.

• Bitnami/gitlab—upgrade to 13.11.6 or later

Is CVE-2021-22232 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 9.5.0, < 13.11.6, >= 13.12.0, < 13.12.6, >= 14.0.0, < 14.0.2

CVSS scores

References (4)

• WEBgitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22232.json
• WEBgitlab.com/gitlab-org/gitlab/-/issues/300713
• WEBhackerone.com/reports/1090634
• WEBnvd.nist.gov/vuln/detail/CVE-2021-22232