CVE-2021-22250: Medium severity gitlab vulnerability
Published Aug 25, 2021
·Updated
Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account
Affected Software
6 affected components
GitLab GitLab>=13.3.0<13.12.9
GitLab GitLab>=13.3.0<13.12.9
GitLab GitLab>=14.0.0<14.0.7
GitLab GitLab>=14.0.0<14.0.7
GitLab GitLab>=14.1.0<14.1.2
GitLab GitLab>=14.1.0<14.1.2
Event History
Aug 25, 2021
CVE Published
via MITRE·06:28 PM
Data Sourced
via MITRE·06:28 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22250?
CVE-2021-22250 is rated as a high severity vulnerability due to improper authorization allowing unauthorized access to impersonation tokens.
2
How do I fix CVE-2021-22250?
To fix CVE-2021-22250, upgrade to GitLab versions 13.12.10, 14.0.8, or 14.1.3 or later.
3
Who is affected by CVE-2021-22250?
CVE-2021-22250 affects all versions of GitLab CE and EE from version 13.3 to 14.1.2.
4
What types of tokens can be accessed due to CVE-2021-22250?
CVE-2021-22250 allows unauthorized users to view and delete impersonation tokens created by administrators.
5
What is the impact of CVE-2021-22250?
The impact of CVE-2021-22250 includes the potential for unauthorized users to compromise the security of administrator impersonation tokens.