CVE-2021-22171

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=11.5.0, <13.5.6; >=13.6.0, <13.6.4; >=13.7.0, <13.7.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22171.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab-pages/-/issues/262Broken Link
https://hackerone.com/reports/718460Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22171.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab-pages/-/issues/262Broken Link
https://hackerone.com/reports/718460Permissions Required, Third Party Advisory

Timeline

Published: Jan 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-221724.3Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases CVE-2021-221737.5Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file CVE-2021-221747.5Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file CVE-2021-221759.8When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions CVE-2021-221764.3An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to CVE-2021-221774.3Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource CVE-2021-221785.0An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheu CVE-2021-221795.4A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.CVE-2021-22188.3Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Health Center). Supported versions that a CVE-2021-221804.3An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to acces CVE-2021-221816.5A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relati CVE-2021-221825.4An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.