CVE-2021-22205
CRITICAL
10,0
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
HIGH
7,5
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: none
Confidentiality: partial
Integrity: partial
Availability: partial
Description
AI Translation Available
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,9447
Percentile
1,0th
Updated
EPSS Score Trend (Last 91 Days)
94
Improper Control of Generation of Code ('Code Injection')
DraftCommon Consequences
Security Scopes Affected:
Access Control
Integrity
Confidentiality
Availability
Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Hide Activities
Applicable Platforms
Languages:
Interpreted
Technologies:
AI/ML
Exploit
GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)
GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)
View Exploit Code →
Application
Gitlab by Gitlab
Version Range Affected
From
11.9.0
(inclusive)
To
13.8.8
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
Version Range Affected
From
13.9.0
(inclusive)
To
13.9.6
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
Version Range Affected
From
13.10.0
(inclusive)
To
13.10.3
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
Version Range Affected
From
13.10.0
(inclusive)
To
13.10.3
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
Version Range Affected
From
13.9.0
(inclusive)
To
13.9.6
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
Version Range Affected
From
11.9.0
(inclusive)
To
13.8.8
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021…
http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifT…
http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Executio…
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json
https://gitlab.com/gitlab-org/gitlab/-/issues/327121
https://hackerone.com/reports/1154542
http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifT…
http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Executio…
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json
https://gitlab.com/gitlab-org/gitlab/-/issues/327121
https://hackerone.com/reports/1154542