CVE-2021-22180 : An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unautho

An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.

Published 2021-03-26 20:15:12

Updated 2022-07-12 17:42:04

Source GitLab Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-22180

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 33 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-22180

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	GitLab Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

References for CVE-2021-22180

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22180.json

2021/CVE-2021-22180.json · master · GitLab.org / cves · GitLab
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/295662

Analytics visible to non member users despite `Only Project Members` (#295662) · Issues · GitLab.org / GitLab · GitLab
Exploit;Issue Tracking;Vendor Advisory
https://hackerone.com/reports/1064645

Sign in
Permissions Required;Third Party Advisory

Products affected by CVE-2021-22180

Gitlab » Gitlab » Community Edition
Versions from including (>=) 13.6.0 and before (<) 13.6.7
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 13.7.0 and before (<) 13.7.7
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 13.6.0 and before (<) 13.6.7
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 13.7.0 and before (<) 13.7.7
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 13.8.0 and before (<) 13.8.4
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 13.8.0 and before (<) 13.8.4
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions

Vulnerability Details : CVE-2021-22180

Exploit prediction scoring system (EPSS) score for CVE-2021-22180

CVSS scores for CVE-2021-22180

CWE ids for CVE-2021-22180

References for CVE-2021-22180

Products affected by CVE-2021-22180