An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with 'external' status which is granted 'Maintainer' role on any project on the GitLab instance where 'project tokens' are allowed may elevate its privilege to 'Internal' and access Internal projects.
References
Link | Resource |
---|---|
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22263.json | Vendor Advisory |
https://gitlab.com/gitlab-org/gitlab/-/issues/331473 | Exploit Issue Tracking Vendor Advisory |
https://hackerone.com/reports/1193062 | Exploit Third Party Advisory |
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22263.json | Vendor Advisory |
https://gitlab.com/gitlab-org/gitlab/-/issues/331473 | Exploit Issue Tracking Vendor Advisory |
https://hackerone.com/reports/1193062 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:49
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 5.5
v3 : 5.5 |
References | () https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22263.json - Vendor Advisory | |
References | () https://gitlab.com/gitlab-org/gitlab/-/issues/331473 - Exploit, Issue Tracking, Vendor Advisory | |
References | () https://hackerone.com/reports/1193062 - Exploit, Third Party Advisory |
Information
Published : 2021-10-11 17:15
Updated : 2024-11-21 05:49
NVD link : CVE-2021-22263
Mitre link : CVE-2021-22263
CVE.ORG link : CVE-2021-22263
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-269
Improper Privilege Management