Vulnerability · Published Apr 2, 2021 · Assigned by GitLab

CVE-2021-22203

High 7.5

In plain English

A high-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.4%top 27.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.

Affected products (as reported)

Vendor	Product	Versions
GitLab	GitLab	>=13.10, <13.10.1>=13.9, <13.9.5>=13.7.9, <13.8.7

References

https://gitlab.com/gitlab-org/gitlab/-/issues/320919 x_refsource_MISC
https://hackerone.com/reports/1098793 x_refsource_MISC
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22203.json x_refsource_CONFIRM