CVE-2021-22236: High severity gitlab vulnerability
Published Aug 25, 2021
·Updated
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.
Affected Software
2 affected components
GitLab GitLab>=14.1.0<14.1.2
GitLab GitLab>=14.1.0<14.1.2
Event History
Aug 25, 2021
CVE Published
via MITRE·06:39 PM
Data Sourced
via MITRE·06:39 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22236?
CVE-2021-22236 has been classified with a moderate severity level due to the improper handling of OAuth client IDs.
2
How do I fix CVE-2021-22236?
To fix CVE-2021-22236, upgrade your GitLab instance to version 14.1.3 or later.
3
Which versions of GitLab are affected by CVE-2021-22236?
CVE-2021-22236 affects GitLab CE/EE versions from 14.1.0 to 14.1.2.
4
What are the risks associated with CVE-2021-22236?
The risks associated with CVE-2021-22236 include unauthorized access due to incorrect OAuth token generation.
5
Is CVE-2021-22236 applicable to both GitLab CE and EE?
Yes, CVE-2021-22236 affects both GitLab Community Edition (CE) and Enterprise Edition (EE) versions.