CVE-2021-22252: Medium severity gitlab vulnerability
Published Aug 23, 2021
·Updated
A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers
Affected Software
6 affected components
GitLab GitLab>=13.7.0<13.12.9
GitLab GitLab>=13.7.0<13.12.9
GitLab GitLab>=14.0.0<14.0.7
GitLab GitLab>=14.0.0<14.0.7
GitLab GitLab>=14.1.0<14.1.2
GitLab GitLab>=14.1.0<14.1.2
Event History
Aug 23, 2021
CVE Published
via MITRE·07:36 PM
Data Sourced
via MITRE·07:36 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22252?
CVE-2021-22252 is classified as a medium severity vulnerability impacting GitLab.
2
How do I fix CVE-2021-22252?
To fix CVE-2021-22252, upgrade your GitLab instance to a version later than 13.12.9 or 14.0.7.
3
Who is affected by CVE-2021-22252?
CVE-2021-22252 affects all GitLab Community and Enterprise editions from version 13.7 to 14.1.2.
4
What does CVE-2021-22252 allow unauthorized access to?
CVE-2021-22252 allows Developers to access protected CI variables that should only be visible to Maintainers.
5
What versions of GitLab are vulnerable to CVE-2021-22252?
Versions of GitLab from 13.7.0 to 14.1.2 are vulnerable to CVE-2021-22252.