Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-22228

An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14.0 before 14.0.2. Improper access control allows unauthorised users to access project details using Graphql.

Published

2021-07-06T22:15:08.470

Last Modified

2024-11-21T05:49:45.130

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	gitlab	gitlab	< 13.11.6	Yes
Application	gitlab	gitlab	< 13.12.6	Yes
Application	gitlab	gitlab	< 14.0.2	Yes

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22228.json Vendor Advisory ([email protected])
https://gitlab.com/gitlab-org/gitlab/-/issues/332605 Exploit, Issue Tracking, Patch, Vendor Advisory ([email protected])
https://hackerone.com/reports/1192460 Exploit, Issue Tracking, Third Party Advisory ([email protected])
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22228.json Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://gitlab.com/gitlab-org/gitlab/-/issues/332605 Exploit, Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/1192460 Exploit, Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)