CVE-2021-22176 — Incorrect Authorization in Gitlab

CWE-863 — Incorrect Authorization5 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

0.1%

top 73.44%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Debian Gitlab

Timeline

PublishedMar 24

Latest updateMay 24

Description

An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDgitlab/gitlab3.0.1 — 13.6.7+2

▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)

▶CVEListV5gitlab/gitlab>=13.7.0, <13.7.7, >=13.8.0, <13.8.4, >=3.0.1, <13.6.7+2

▶gitlabgitlab/gitlab

🔴Vulnerability Details

GHSA

GHSA-x4h7-gg27-pw2v: An issue has been discovered in GitLab affecting all versions starting with 3↗2022-05-24

▶

OSV

CVE-2021-22176: An issue has been discovered in GitLab affecting all versions starting with 3↗2021-03-24

▶

📋Vendor Advisories

GitLab

CVE-2021-22176: An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access de↗2021-03-24

▶

Debian

CVE-2021-22176: gitlab - An issue has been discovered in GitLab affecting all versions starting with 3.0....↗2021

▶