PT-2021-4075 · Gitlab · Gitlab

Mysteron · Published 2021-01-05 · Updated 2026-04-11 · CVE-2021-22175

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab versions 10.5 and later

Description The issue is a server-side request forgery (SSRF) in GitLab. When requests to the internal network for webhooks are enabled, an unauthenticated attacker can exploit this issue, even on a GitLab instance where registration is disabled. The vulnerability is caused by insecure handling of requests, potentially allowing an attacker to access confidential data and disrupt service.

Recommendations GitLab versions 10.5 and later: Disable requests to the internal network for webhooks to mitigate the risk of server-side request forgery.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2021-04653

BIT-GITLAB-2021-22175

CVE-2021-22175

Affected Products

Gitlab

References · 30

• https://nvd.nist.gov/vuln/detail/CVE-2021-22175 · Security Note
• https://ubuntu.com/security/CVE-2021-22175 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22175 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22175 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22175 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22175 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04653 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2021-22175 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/294178 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22175 · Note
• https://hackerone.com/reports/1059596 · Note
• https://twitter.com/ctiwatchcloud/status/2042996173691052189 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175 · Note
• https://twitter.com/pdnuclei_bot/status/2003375057343836452 · Twitter Post
• https://greynoise.io/blog/new-ssrf-exploitation-surge · Note