PT-2021-4077 · Gitlab · Gitlab

Published 2021-01-05 · Updated 2024-03-06 · CVE-2021-22206

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 11.6 and later

Description The issue is related to the exposure of pull mirror credentials in GitLab, allowing other maintainers to view the credentials in plain-text. This could potentially enable a remote attacker to gain access to confidential data.

Recommendations For GitLab versions 11.6 and later, update to a version that includes a fix for the exposed pull mirror credentials issue. As a temporary workaround, consider restricting access to the pull mirror credentials to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BDU:2021-04655

BIT-GITLAB-2021-22206

CVE-2021-22206

Affected Products

Gitlab

References · 13

• https://cve.org/CVERecord?id=CVE-2021-22206 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22206 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22206 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-22206 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22206.json · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-22206 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22206 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04655 · Security Note
• https://t.me/cvenotify/14370 · Telegram Post
• https://hackerone.com/reports/928074 · Note
• https://t.me/cvenotify/14166 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/230864 · Note