CVE-2021-22261

 

Published at: - 05-10-2021 04:15

Last modified: - 21-07-2022 12:46

Total changes: - 4

Description

A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious Jira API responses

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://gitlab.com/gitlab-org/gitlab/-/issues/328389
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22261.json
• https://hackerone.com/reports/1132083

 

Keywords

NVD

 

CVE-2021-22261

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures