01 Record

CVE-2021-22183

An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.

MediumPUBLISHEDCNA: GitLab

CNA base score4.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

View raw JSON

02 Description

An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.83% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 57.3% of scored records. A rank, not a probability.
NVD base score: 5.4 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2021-03-04 14:56Z5 YR AGO

Last updated

2024-08-03 18:37Z2 YR AGO

Reserved

2021-01-05

Assigning CNA

GitLab

Record state

PUBLISHED

Severity

Medium (CVSS 4.1)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

Data version

5.1

Document digest

923fd707fc62893ef94be619f6c855af778867caa6fbfa61575a6c72de8d5c4b

05 Affected products

VendorProductVersionsPlatforms

GitLabGitLab>=13.8, <13.8.2, >=13.7, <13.7.6, >=11.8, <13.6.6—

06 References

gitlab.comhttps://gitlab.com/gitlab-org/gitlab/-/issues/294176x_refsource_MISC
hackerone.comhttps://hackerone.com/reports/1055814x_refsource_MISC
gitlab.comhttps://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22183.jsonx_refsource_CONFIRM

07 Fixed in

Ubuntu 16.04 LTS

gitlab
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.