PT-2021-4079 · Gitlab · Gitlab Ce/Ee+1

Published 2021-01-05 · Updated 2024-03-06 · CVE-2021-22209

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.8 and later

Description The issue is related to improper validation of authorization tokens in GitLab, which can result in the execution of GraphQL mutations. This can potentially allow a remote attacker to impact data integrity.

Recommendations For GitLab CE/EE versions 13.8 and later, consider disabling GraphQL mutations until a proper fix for the authorization token validation issue is available. Restrict access to sensitive data and functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2021-04657

BIT-GITLAB-2021-22209

CVE-2021-22209

Affected Products

Gitlab

Gitlab Ce/Ee

References · 12

• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22209.json · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22209 · Security Note
• https://ubuntu.com/security/CVE-2021-22209 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22209 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22209 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22209 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04657 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2021-22209 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/327155 · Note
• https://t.me/cvenotify/14161 · Telegram Post
• https://t.me/cvenotify/14153 · Telegram Post