PT-2021-6484 · Gitlab · Gitlab Ce/Ee+1

Published 2021-08-23 · Updated 2024-03-06 · CVE-2021-22248

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.12 and later

Description The issue is related to improper authorization on the pipelines page, allowing unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only. This could potentially allow a remote attacker to access confidential data.

Recommendations For GitLab CE/EE versions 13.12 and later, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the pipelines page for public projects to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-01733

BIT-GITLAB-2021-22248

CVE-2021-22248

Affected Products

Gitlab

Gitlab Ce/Ee

References · 14

• https://ubuntu.com/security/CVE-2021-22248 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-22248 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22248.json · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22248 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01733 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-22248 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22248 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22248 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22248 · Vendor Advisory
• https://t.me/cibsecurity/27732 · Telegram Post
• https://t.me/cvenotify/19937 · Telegram Post
• https://t.me/cvenotify/20303 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/336074 · Note
• https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released · Note