PT-2021-4087 · Gitlab · Gitlab Ce/Ee+1

Published

2021-01-05

·

Updated

2024-03-06

·

CVE-2021-22219

CVSS v3.1

4.9

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 9.5 through 13.10.4 GitLab CE/EE versions 13.11 through 13.11.4 GitLab CE/EE versions 13.12 through 13.12.1
Description The issue allows a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking. This is related to insufficient protection of registration data, which can be exploited by a remote attacker to gain access to confidential data.
Recommendations For GitLab CE/EE versions 9.5 through 13.10.4, update to version 13.10.5 or later. For GitLab CE/EE versions 13.11 through 13.11.4, update to version 13.11.5 or later. For GitLab CE/EE versions 13.12 through 13.12.1, update to version 13.12.2 or later.

Fix

Insertion into Log File

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2021-04665
BIT-GITLAB-2021-22219
CVE-2021-22219

Affected Products

Gitlab
Gitlab Ce/Ee