HIGH

CVE-2021-22236

Gitlab GitLab 2021-08-25 CVSS v3.1

CVSS

8.8

Description

Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.

Summary dbcve.org

GitLab incorrectly generated OAuth tokens on the wrong OAuth client application when creating new subscriptions due to improper handling of OAuth client IDs. This could allow tokens intended for one application to be associated with a different OAuth client, potentially leading to unauthorized access to resources or data leakage across applications.

Mitigation

Upgrade GitLab CE/EE to the patched version. Review existing OAuth tokens and client configurations to verify no unauthorized access occurred through the misrouted tokens.

Weakness (CWE)

CWE-863 Incorrect Authorization

EPSS Score

0.87%

Probability of exploitation in next 30 days

57.1th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22236.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/334925 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE