PT-2021-6601 · Gitlab · Gitlab Ce/Ee+1

Jimenoon · Published 2021-05-22 · Updated 2024-03-06 · CVE-2021-22250

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.3 and later

Description The issue is related to improper authorization in GitLab, allowing users to view and delete impersonation tokens created by administrators for their account. This can be exploited by a remote attacker to access and compromise confidential data.

Recommendations For GitLab CE/EE versions 13.3 and later, update to a version that includes a fix for this issue to prevent users from viewing and deleting impersonation tokens that administrators created for their account. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-01867

BIT-GITLAB-2021-22250

CVE-2021-22250

Affected Products

Gitlab

Gitlab Ce/Ee

References · 14

• https://security-tracker.debian.org/tracker/CVE-2021-22250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22250 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22250 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-22250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22250 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22250.json · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-22250 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01867 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-22250 · Security Note
• https://t.me/cibsecurity/27881 · Telegram Post
• https://t.me/cvenotify/20086 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/332410 · Note
• https://hackerone.com/reports/1205916 · Note
• https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released · Note