Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-22239: GitLab allows unauthorized metadata insertion on new issues

CVE-2021-22239 · published 5 years ago

Summary

In GitLab Community and Enterprise editions version 14.0 and newer, an attacker who can access the issue creation page can add hidden data to a new issue. This could be used to store malicious information or track activity without permission. Apply the latest GitLab update or follow the vendor's guidance to block this behavior.

What to do

Update gitlab to version 14.1.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Bitnami	–	gitlab	>= 14.1.0, < 14.1.2 Fix: upgrade to 14.1.2
–	gitlab	gitlab	>= 14.0.0, < 14.0.7 >= 14.1.0, < 14.1.2 `cpe:2.3:a:gitlab:gitlab:::::community:::*`

Original advisory text

An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22239.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/336301 Broken Link
https://nvd.nist.gov/vuln/detail/CVE-2021-22239 URL

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published9 Sep 2021

Updated4 Nov 2026

First seen27 Aug 2026

Sources

CVE-2021-22239 · OSV

CVE-2021-22239 · NVD

BIT-gitlab-2021-22239 · OSV

Track software like this

Free during beta