Cross-site request forgery in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2021-22224
Published: July 6, 2021 / Updated: July 6, 2021
Vulnerability identifier: #VU54563
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-22224
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in the GraphQL API. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, such as call mutations as the victim.
Affected software
Gitlab Community Edition
GitLab Enterprise Edition
GitLab Enterprise Edition
How to mitigate CVE-2021-22224
Install updates from vendor's website.
Gitlab Community Edition - addressed in versions 13.12.6, 14.0.2
GitLab Enterprise Edition - addressed in versions 13.12.6, 14.0.2
GitLab Enterprise Edition - addressed in versions 13.12.6, 14.0.2