Vulnerability Details CVE-2021-22224
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 58.3%
CVSS Severity
CVSS v3 Score 7.1
CVSS v2 Score 4.3
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/324397
- https://hackerone.com/reports/1122408
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/324397
- https://hackerone.com/reports/1122408
Products affected by CVE-2021-22224
-
cpe:2.3:a:gitlab:gitlab:13.12.0
-
cpe:2.3:a:gitlab:gitlab:13.12.1
-
cpe:2.3:a:gitlab:gitlab:13.12.2
-
cpe:2.3:a:gitlab:gitlab:13.12.3
-
cpe:2.3:a:gitlab:gitlab:13.12.4
-
cpe:2.3:a:gitlab:gitlab:13.12.5
-
cpe:2.3:a:gitlab:gitlab:14.0.0
-
cpe:2.3:a:gitlab:gitlab:14.0.1