CVE-2021-22257: Medium severity gitlab vulnerability
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-22257?
CVE-2021-22257 has a medium severity rating due to the potential for user enumeration.
How do I fix CVE-2021-22257?
To fix CVE-2021-22257, users must upgrade GitLab to version 14.0.9, 14.1.4, or 14.2.2 or later.
What versions of GitLab are affected by CVE-2021-22257?
CVE-2021-22257 affects GitLab versions from 14.0.0 before 14.0.9, 14.1.0 before 14.1.4, and 14.2.0 before 14.2.2.
What is the main issue with CVE-2021-22257?
The main issue with CVE-2021-22257 is that the /user.keys route is not restricted on instances with public visibility disabled.
Can public visibility settings mitigate CVE-2021-22257?
While public visibility settings are intended to limit access, CVE-2021-22257 can still be exploited under certain configurations where visibility is not fully enforced.