PT-2019-6205 · Gitlab · Gitlab Ce/Ee+1

Ashish_R_Padelkar · Published 2019-08-22 · Updated 2024-03-06 · CVE-2021-22251

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.2 and later

Description The issue is related to improper validation of invited users' email addresses, allowing projects to add members with email address domains that should be blocked by group settings. This can be exploited by a remote attacker to impact data integrity.

Recommendations For GitLab EE versions 12.2 and later, update to a version that includes the fix for the improper validation of invited users' email addresses. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-02144

BIT-GITLAB-2021-22251

CVE-2021-22251

Affected Products

Gitlab

Gitlab Ce/Ee

References · 16

• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/14004 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-22251 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-22251 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22251.json · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22251 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22251 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02144 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-22251 · Security Note
• https://ubuntu.com/security/CVE-2021-22251 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-22251 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22251 · Note
• https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released · Note
• https://hackerone.com/reports/679567 · Note
• https://t.me/cvenotify/20305 · Telegram Post
• https://t.me/cvenotify/19935 · Telegram Post