HIGH

CVE-2021-22192

Gitlab GitLab 2021-03-24 CVSS v3.1

CVSS

8.8

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.

Summary dbcve.org

GitLab CE/EE versions 13.2 and later contain an authentication bypass vulnerability allowing any authenticated user (regardless of authorization level) to execute arbitrary code on the server through the web interface or API.

Mitigation

Upgrade GitLab to the patched version as specified in the official GitLab security release. Restrict network access to GitLab instances while pending updates.

EPSS Score

13.11%

Probability of exploitation in next 30 days

96.2th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22192.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/324452 Broken Link https://hackerone.com/reports/1125425 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE