CVE-2021-22206 — Cleartext Storage of Sensitive Info in Gitlab

CWE-312 — Cleartext Storage of Sensitive Info5 documents5 sources
Severity
4.9MEDIUMNVD
EPSS
0.1%
top 69.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedMay 6
Latest updateMay 24

Description

An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text,

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages4 packages

▶NVDgitlab/gitlab11.6.0 — 13.9.7+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=11.6, <13.9.7, >=13.10.0, <13.10.4, >=13.11.0, <13.11.2+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-6g79-3r2c-5vxg: An issue has been discovered in GitLab affecting all versions starting from 11↗2022-05-24
▶
OSV
CVE-2021-22206: An issue has been discovered in GitLab affecting all versions starting from 11↗2021-05-06
▶

📋Vendor Advisories

2
GitLab
CVE-2021-22206: An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to↗2021-05-06
▶
Debian
CVE-2021-22206: gitlab - An issue has been discovered in GitLab affecting all versions starting from 11.6...↗2021
▶