PT-2021-4083 · Gitlab · Gitlab Ce/Ee+1

Published 2021-01-05 · Updated 2026-06-16 · CVE-2021-22214

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.5 and later

Description A server-side request forgery vulnerability in GitLab CE/EE allows an unauthenticated attacker to exploit the issue when requests to the internal network for webhooks are enabled. This vulnerability is related to insufficient validation of incoming requests and can be exploited by a remote attacker to gain access to confidential data.

Recommendations For versions 10.5 and later, consider disabling the webhook functionality until a patch is available to prevent exploitation of the server-side request forgery vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2021-04661

BIT-GITLAB-2021-22214

CVE-2021-22214

Affected Products

Gitlab

Gitlab Ce/Ee

References · 21

• 🔥 https://github.com/antx-code/CVE-2021-22214 · Exploit
• 🔥 https://github.com/ZZ-SOCMAP/CVE-2021-22214 · Exploit
• 🔥❌ https://github.com/r0ckysec/CVE-2021-22214 · Exploit, Deleted
• https://osv.dev/vulnerability/BIT-gitlab-2021-22214 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22214 · Security Note
• https://bdu.fstec.ru/vul/2021-04661 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-22214 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22214 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22214 · Security Note
• https://ubuntu.com/security/CVE-2021-22214 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22214.json · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/322926 · Note
• https://twitter.com/ishankaru/status/2066724866024255981 · Twitter Post
• https://greynoise.io/blog/new-ssrf-exploitation-surge · Note