CVE-2021-22263
First published: Mon Oct 11 2021(Updated: )
An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with 'external' status which is granted 'Maintainer' role on any project on the GitLab instance where 'project tokens' are allowed may elevate its privilege to 'Internal' and access Internal projects.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=13.0.0<14.0.9 | |
| GitLab | >=13.0.0<14.0.9 | |
| GitLab | >=14.1.0<14.1.4 | |
| GitLab | >=14.1.0<14.1.4 | |
| GitLab | >=14.2.0<14.2.2 | |
| GitLab | >=14.2.0<14.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-22263?
CVE-2021-22263 has been classified as a medium severity vulnerability.
How do I fix CVE-2021-22263?
To fix CVE-2021-22263, upgrade GitLab to version 14.0.9 or above, or 14.1.4 or above, or 14.2.2 or above.
What impact does CVE-2021-22263 have on GitLab?
CVE-2021-22263 allows a user account with 'external' status to gain 'Maintainer' privileges on project repositories.
Which versions of GitLab are affected by CVE-2021-22263?
CVE-2021-22263 affects GitLab versions from 13.0 to below 14.0.9, from 14.1 to below 14.1.4, and from 14.2 to below 14.2.2.
Is there a workaround for CVE-2021-22263?
The recommended action for CVE-2021-22263 is to apply the necessary updates rather than relying on a workaround.
- agent/type
- agent/references
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/13.0.0
- version/gitlab/14.1.0
- version/gitlab/14.2.0