CVE-2021-39887

Published: 5 October 2021

A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf.

Priority

CVSS 3 base score: 5.4

Status

Package	Release	Status
gitlab Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	hirsute	Does not exist
	impish	Does not exist
	jammy	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Ignored (out of standard support)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39887
https://hackerone.com/reports/1218174
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39887.json
https://gitlab.com/gitlab-org/gitlab/-/issues/332903
NVD
Launchpad
Debian

Bugs

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›