Description

An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.

Related CPE's

a

gitlab

gitlab

2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22202.json

Vendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/26017

Broken Link

https://hackerone.com/reports/471274

Permissions RequiredThird Party Advisory

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22202.json

Vendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/26017

Broken Link

https://hackerone.com/reports/471274

Permissions RequiredThird Party Advisory

Weaknesses

[email protected]

Primary
CWE-352

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

2.4 · Low

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2021-04-02T15:15:13.007Z

4 years ago

Last modified

2024-11-21T04:49:42.003Z

1 year ago