Skip to content
OpenAdvisories
Low · 3.5 CVE-2021-22232 EUVD-2021-9378GHSA-q5w6-p37j-cwr4

HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE

Published Jul 6, 2021 · Updated Aug 3, 2024 · Assigned by GitLab

Vendor: GitLab Product: GitLab Package: gitlab Category: Web / CMS Ecosystem: Ubuntu

Description

HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE

Affected products

VendorProductAffectedFixed
GitLab GitLab >=9.5, <13.11.6, >=13.12, <13.12.6, >=14.0, <14.0.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS gitlab No fix yet —

References