CVE-2021-22172: Infoleak
Published Mar 26, 2021
·Updated
Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page
Affected Software
6 affected components
GitLab GitLab>=12.8.0<13.6.6
GitLab GitLab>=12.8.0<13.6.6
GitLab GitLab>=13.7.0<13.7.6
GitLab GitLab>=13.7.0<13.7.6
GitLab GitLab>=13.8.0<13.8.2
GitLab GitLab>=13.8.0<13.8.2
Remediation
Patch Available
Event History
Mar 26, 2021
CVE Published
via MITRE·07:06 PM
Data Sourced
via MITRE·07:06 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22172?
CVE-2021-22172 has a medium severity rating due to improper authorization vulnerabilities impacting GitLab users.
2
How do I fix CVE-2021-22172?
To fix CVE-2021-22172, you need to update GitLab to version 13.8.2 or later.
3
Who is affected by CVE-2021-22172?
CVE-2021-22172 affects GitLab versions 12.8.0 to 13.6.6 for both community and enterprise editions.
4
What impact does CVE-2021-22172 have?
CVE-2021-22172 allows guest users in a private project to view tag data that should be restricted, potentially exposing sensitive information.
5
When was CVE-2021-22172 disclosed?
CVE-2021-22172 was disclosed in early 2021, highlighting security issues in certain versions of GitLab.