CVE-2021-22261
Severity Score
4.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious Jira API responses
Una vulnerabilidad de Cross-Site Scripting almacenada en la integración de Jira en todas las versiones de GitLab a partir de la 13.9 antes de la 14.0.9, todas las versiones a partir de la 14.1 antes de la 14.1.4 y todas las versiones a partir de la 14.2 antes de la 14.2.2 permite a un atacante ejecutar código JavaScript arbitrario en nombre de la víctima a través de respuestas maliciosas de la API de Jira
*Credits:
Thanks thornguyen for reporting this vulnerability through our HackerOne bug bounty program
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-01-05 CVE Reserved
- 2021-10-05 CVE Published
- 2023-08-22 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/328389 | Broken Link |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22261.json | 2022-07-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.9.0 < 14.0.9 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.9.0 < 14.0.9" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.9.0 < 14.0.9 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.9.0 < 14.0.9" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 14.1.0 < 14.1.4 Search vendor "Gitlab" for product "Gitlab" and version " >= 14.1.0 < 14.1.4" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 14.1.0 < 14.1.4 Search vendor "Gitlab" for product "Gitlab" and version " >= 14.1.0 < 14.1.4" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 14.2.0 < 14.2.2 Search vendor "Gitlab" for product "Gitlab" and version " >= 14.2.0 < 14.2.2" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 14.2.0 < 14.2.2 Search vendor "Gitlab" for product "Gitlab" and version " >= 14.2.0 < 14.2.2" | enterprise |
Affected
| ||||||