CVE-2021-22260

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=13.7, <14.0.9; >=14.1, <14.1.4; >=14.2, <14.2.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22260.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/336614Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1257383Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22260.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/336614Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1257383Permissions Required, Third Party Advisory

Timeline

Published: Nov 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-222614.8A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions st CVE-2021-222624.3Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all vers CVE-2021-222636.5An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222646.5An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222675.9Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0 CVE-2021-22278.1Vulnerability in the Oracle Cash Management product of Oracle E-Business Suite (component: Bank Account Transfer). Supported versions that a CVE-2021-222729.4The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to CVE-2021-222758.6Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic progra CVE-2021-222765.5The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.CVE-2021-222777.5Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control an CVE-2021-222786.7A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on compute CVE-2021-222799.8A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the rob