VulnerabilityModified
CVE-2021-22224
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim
MEDIUM 6.5EPSS 0.89%
Does this matter?
Lower severity and a low EPSS score (0.89%). Track it; it rarely justifies an emergency change on its own.
Description
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 0.89% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.jsonThird Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/324397Broken Link
- https://hackerone.com/reports/1122408Permissions Required
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.jsonThird Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/324397Broken Link
- https://hackerone.com/reports/1122408Permissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.