Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2021-22214 — Server-Side Request Forgery in Gitlab
Severity
8.6HIGHNVD
VulnCheck6.8
EPSS
93.8%
top 0.14%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJun 8
Latest updateMar 11
Description
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NExploitability: 3.9 | Impact: 4.0
Affected Packages5 packages
🔴Vulnerability Details
3GHSA▶
GHSA-6jpw-pq5v-3x7w: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions sta↗2022-05-24
OSV▶
CVE-2021-22214: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions sta↗2021-06-08
💥Exploits & PoCs
1Nuclei▶
Gitlab CE/EE 10.5 - Server-Side Request Forgery
📋Vendor Advisories
2GitLab▶
CVE-2021-22214: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions sta↗2021-06-08
Debian▶
CVE-2021-22214: gitlab - When requests to the internal network for webhooks are enabled, a server-side re...↗2021