Ubuntu.comUB:CVE-2021-39885CVE-2021-39885
3.5 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
8.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
0.001 Low
EPSS
Percentile
29.6%
A Stored XSS in merge request creation page in all versions of Gitlab EE
starting from 13.7 before 14.1.7, all versions starting from 14.2 before
14.2.5, and all versions starting from 14.3 before 14.3.1 allows an
attacker to execute arbitrary JavaScript code on the victim’s behalf via
malicious approval rule names
References
gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39885.json
gitlab.com/gitlab-org/gitlab/-/issues/341140
hackerone.com/reports/1342009
launchpad.net/bugs/cve/CVE-2021-39885
nvd.nist.gov/vuln/detail/CVE-2021-39885
security-tracker.debian.org/tracker/CVE-2021-39885
www.cve.org/CVERecord?id=CVE-2021-39885
Related
3.5 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
8.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
0.001 Low
EPSS
Percentile
29.6%