CVE-2021-22202: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab CE/EE affecting all previous versions, identified as CVE-2021-22202. The vulnerability allowed an attacker to execute a Cross-Site Request Forgery (CSRF) attack in System hooks through the API if the victim had admin privileges (GitLab Security).

The vulnerability was classified as a low severity issue with a CVSS v3.1 score of 4.3 (MEDIUM) and CVSS v2.0 score of 4.3 (MEDIUM). The vulnerability specifically affected the system hooks functionality accessible through the API endpoint, where an admin could be tricked into executing unintended hook actions through CSRF attacks (NVD Results).

If successfully exploited, an attacker could cause system hooks to be executed undesirably when an admin visits a malicious page. This could lead to unauthorized actions being performed across all projects in the GitLab instance (GitLab Issue).

The issue was patched in GitLab security releases 13.10.1, 13.9.5, and 13.8.7. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately (GitLab Security).

The vulnerability was reported through GitLab's HackerOne bug bounty program by security researcher @mishre, demonstrating the effectiveness of GitLab's security response program (GitLab Security).