MEDIUM

CVE-2021-22256

Gitlab GitLab 2021-08-25 CVSS v3.1

CVSS

5.4

Description

Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status

Summary dbcve.org

Improper authorization in GitLab CE/EE allowed guest users (who normally have read-only access) to create issues for Sentry errors and track their status. This authorization bypass enabled users with guest-level permissions to perform write operations they should not have been able to do.

Mitigation

Upgrade GitLab to version 13.12.14, 14.0.11, 14.1.7, or later to remediate the improper authorization vulnerability.

Weakness (CWE)

CWE-863 Incorrect Authorization

EPSS Score

0.73%

Probability of exploitation in next 30 days

52.8th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22256.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/326948 Broken Link https://hackerone.com/reports/1117768 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE