CVE-2021-22172

Description

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page

How to fix CVE-2021-22172

To remediate CVE-2021-22172, upgrade the affected package to a fixed version below.

• Bitnami/gitlab—upgrade to 13.6.6 or later

Is CVE-2021-22172 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 12.8.0, < 13.6.6, >= 13.7.0, < 13.7.6, >= 13.8.0, < 13.8.2

CVSS scores

References (4)

• WEBgitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22172.json
• WEBgitlab.com/gitlab-org/gitlab/-/issues/212911
• WEBhackerone.com/reports/833334
• WEBnvd.nist.gov/vuln/detail/CVE-2021-22172