CVE-2021-22178: SSRF
Published Mar 24, 2021
·Updated
An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration.
Affected Software
6 affected components
GitLab GitLab>=13.2.0<13.6.7
GitLab GitLab>=13.2.0<13.6.7
GitLab GitLab>=13.7.0<13.7.7
GitLab GitLab>=13.7.0<13.7.7
GitLab GitLab>=13.8.0<13.8.4
GitLab GitLab>=13.8.0<13.8.4
Event History
Mar 24, 2021
CVE Published
via MITRE·04:59 PM
Data Sourced
via MITRE·04:59 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22178?
CVE-2021-22178 is considered a high-severity vulnerability due to its potential exploitation through SRRF attacks.
2
How do I fix CVE-2021-22178?
To fix CVE-2021-22178, upgrade your GitLab instance to version 13.6.8, 13.7.8, or 13.8.5 or later.
3
What versions of GitLab are affected by CVE-2021-22178?
CVE-2021-22178 affects all GitLab versions from 13.2.0 up to but not including 13.6.8.
4
What is a SRRF attack in relation to CVE-2021-22178?
A SRRF attack leverages vulnerabilities in the Prometheus integration within GitLab to potentially disrupt services.
5
Is CVE-2021-22178 related to specific GitLab installations?
Yes, CVE-2021-22178 affects both GitLab Community and Enterprise Editions running the specified versions.