PT-2021-6532 · Gitlab · Gitlab Ce/Ee+1

Vaib25Vicky · Published 2021-08-25 · Updated 2024-03-06 · CVE-2021-22244

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.1 and later

Description The issue is related to improper authorization in the vulnerability report feature, allowing a reporter to access vulnerability data. This could potentially lead to unauthorized access to confidential data. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For GitLab EE versions 13.1 and later, update to a version that includes a fix for the improper authorization issue in the vulnerability report feature. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-01792

BIT-GITLAB-2021-22244

CVE-2021-22244

Affected Products

Gitlab

Gitlab Ce/Ee

References · 14

• https://cve.org/CVERecord?id=CVE-2021-22244 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22244 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22244.json · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22244 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-22244 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22244 · Security Note
• https://bdu.fstec.ru/vul/2022-01792 · Security Note
• https://ubuntu.com/security/CVE-2021-22244 · Vendor Advisory
• https://hackerone.com/reports/1047140 · Note
• https://t.me/cvenotify/20089 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/299039 · Note
• https://t.me/cibsecurity/27872 · Telegram Post
• https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released · Note