CVE-2021-22176: Medium severity gitlab vulnerability
Published Mar 24, 2021
·Updated
An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests
Affected Software
6 affected components
GitLab GitLab>=3.0.1<13.6.7
GitLab GitLab>=3.0.1<13.6.7
GitLab GitLab>=13.7.0<13.7.7
GitLab GitLab>=13.7.0<13.7.7
GitLab GitLab>=13.8.0<13.8.4
GitLab GitLab>=13.8.0<13.8.4
Event History
Mar 24, 2021
CVE Published
via MITRE·04:46 PM
Data Sourced
via MITRE·04:46 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22176?
CVE-2021-22176 has a medium severity level due to improper access control affecting project member information.
2
How do I fix CVE-2021-22176?
To remediate CVE-2021-22176, upgrade your GitLab installation to version 13.9.0 or later.
3
Which versions of GitLab are affected by CVE-2021-22176?
CVE-2021-22176 affects all GitLab versions from 3.0.1 up to 13.8.4.
4
What types of GitLab installations are susceptible to CVE-2021-22176?
Both GitLab Community Edition and GitLab Enterprise Edition installations are susceptible to CVE-2021-22176.
5
What is the nature of the vulnerability in CVE-2021-22176?
CVE-2021-22176 allows demoted project members to access details on authored merge requests due to improper access control.