Vulnerability · Published May 6, 2021 · Assigned by GitLab

CVE-2021-22206

Medium 6.8

In plain English

A medium-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)1.0%top 36.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text,

Affected products (as reported)

Vendor	Product	Versions
GitLab	GitLab	>=11.6, <13.9.7>=13.10.0, <13.10.4>=13.11.0, <13.11.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/230864 x_refsource_MISC
https://hackerone.com/reports/928074 x_refsource_MISC
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22206.json x_refsource_CONFIRM