PT-2021-6756 · Gitlab · Gitlab Ce/Ee+1

Published 2021-08-25 · Updated 2024-03-06 · CVE-2021-22236

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.1 and later

Description The issue is related to the improper handling of OAuth client IDs, which causes new subscriptions to generate OAuth tokens on an incorrect OAuth client application. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For GitLab CE/EE versions 14.1 and later, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-02148

BIT-GITLAB-2021-22236

CVE-2021-22236

Affected Products

Gitlab

Gitlab Ce/Ee

References · 13

• https://osv.dev/vulnerability/CVE-2021-22236 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22236.json · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22236 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-22236 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-22236 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22236 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-22236 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-22236 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02148 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/334925 · Note
• https://t.me/cvenotify/20093 · Telegram Post
• https://t.me/cibsecurity/27886 · Telegram Post
• https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released · Note