CVE-2021-22209: High severity gitlab vulnerability
Published May 6, 2021
·Updated
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed.
Affected Software
6 affected components
GitLab GitLab>=13.8.0<13.9.7
GitLab GitLab>=13.8.0<13.9.7
GitLab GitLab>=13.10.0<13.10.4
GitLab GitLab>=13.10.0<13.10.4
GitLab GitLab>=13.11.0<13.11.2
GitLab GitLab>=13.11.0<13.11.2
Event History
May 6, 2021
CVE Published
via MITRE·01:37 PM
Data Sourced
via MITRE·01:37 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22209?
CVE-2021-22209 has been classified as a high severity vulnerability.
2
How do I fix CVE-2021-22209?
To fix CVE-2021-22209, upgrade GitLab to version 13.9.7 or later for affected versions.
3
What types of GitLab are affected by CVE-2021-22209?
CVE-2021-22209 affects both GitLab Community Edition and Enterprise Edition versions from 13.8.0 to 13.9.7, and also certain versions in the 13.10.x and 13.11.x series.
4
What is the cause of CVE-2021-22209?
The cause of CVE-2021-22209 is improper validation of authorization tokens in GitLab.
5
Is CVE-2021-22209 related to GraphQL?
Yes, CVE-2021-22209 allows unauthorized execution of GraphQL mutations due to the validation issue.