PT-2019-6205 · Gitlab · Gitlab Ce/Ee+1

Ashish_R_Padelkar · Publicado 2019-08-22 · Atualizado 2024-03-06 · CVE-2021-22251

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.2 and later

Description The issue is related to improper validation of invited users' email addresses, allowing projects to add members with email address domains that should be blocked by group settings. This can be exploited by a remote attacker to impact data integrity.

Recommendations For GitLab EE versions 12.2 and later, update to a version that includes the fix for the improper validation of invited users' email addresses. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2022-02144

BIT-GITLAB-2021-22251

CVE-2021-22251

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 16

• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/14004 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22251 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-22251 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2021-22251 · Aviso do Fabricante
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22251.json · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22251 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2021-22251 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-02144 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2021-22251 · Nota de Segurança
• https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released · Nota
• https://hackerone.com/reports/679567 · Nota
• https://ubuntu.com/security/CVE-2021-22251 · Aviso do Fabricante
• https://t.me/cvenotify/20305 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-gitlab-2021-22251 · Aviso do Fabricante
• https://t.me/cvenotify/19935 · Publicação no Telegram