PT-2021-6513 · Gitlab · Gitlab Ce/Ee+1

Vakzz · Published 2021-07-02 · Updated 2024-03-06 · CVE-2021-22234

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.11 through 13.11.6 GitLab CE/EE versions 13.12 through 13.12.7 GitLab CE/EE versions 14.0 through 14.0.3

Description An issue has been discovered in GitLab CE/EE that allows attackers to read arbitrary files on the server by using a specially crafted design image. This issue is related to information disclosure and can be exploited by a remote attacker to access confidential data.

Recommendations For versions 13.11 through 13.11.6, update to version 13.11.7 or later. For versions 13.12 through 13.12.7, update to version 13.12.8 or later. For versions 14.0 through 14.0.3, update to version 14.0.4 or later.

Exploit

Fix

Information Disclosure

XSS

Weakness Enumeration

CWE-200

CWE-79

Related Identifiers

BDU:2022-01773

BIT-GITLAB-2021-22234

CVE-2021-22234

Affected Products

Gitlab

Gitlab Ce/Ee

References · 13

• 🔥 https://hackerone.com/reports/1212067 · Exploit
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22234.json · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01773 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22234 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22234 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22234 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22234 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/335205 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-22234 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22234 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-22234 · Vendor Advisory
• https://t.me/cvenotify/18751 · Telegram Post
• https://t.me/cvenotify/33601 · Telegram Post