Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via cl

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitLab

Description

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GitLab GitLab

  • >=11.9, <13.11.6affected
  • >=13.12, <13.12.6affected
  • >=14.0, <14.0.2affected

References