MEDIUM

CVE-2021-22248

Gitlab GitLab 2021-08-23 CVSS v3.1

CVSS

5.3

Description

Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only

Summary dbcve.org

GitLab CE/EE versions since 13.12 contained an improper authorization vulnerability in the pipelines page. Public projects could restrict pipeline access to members only, but unauthorized (non-member) users could still view some pipeline information, bypassing the intended access controls.

Mitigation

Upgrade GitLab to the patched version (specific version numbers should be obtained from GitLab's security advisory for this CVE).

EPSS Score

1.05%

Probability of exploitation in next 30 days

62.8th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22248.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/336074 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE