CVE-2021-22192

published 2021-03-24

CVE-2021-22192: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on…

Priority P2 61 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 15.10.8+ds1-2 (sid)	gitlab 15.10.8+ds1-2 (sid)
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	>= 13.2.0 < 13.7.9	13.7.9
gitlab	gitlab	>= 13.8.0 < 13.8.6	13.8.6
gitlab	gitlab	>= 13.9.0 < 13.9.4	13.9.4
gitlab	gitlab_ce	—	—

Detection & IOCs extracted from sources · hover to see the quote

• · Vulnerability affects GitLab CE/EE starting from version 13.2; fixed in Debian sid package version 15.10.8+ds1-2. No specific exploit payloads, hashes, or network indicators were present in the provided sources. ↗
• · Scope of exploitation is listed as local in the Debian security tracker, meaning the attack vector requires authenticated access to the GitLab instance rather than remote unauthenticated exploitation. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

osv 8.8 HIGH

vendor_debian 9.9 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.