Vulnerability · Published Aug 23, 2021 · Assigned by GitLab

CVE-2021-22249

Medium 4.3

In plain English

A medium-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)1.0%top 37.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group

Affected products (as reported)

Vendor	Product	Versions
GitLab	GitLab	>=12.2, <13.12.9>=14.0, <14.0.7>=14.1, <14.1.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/331857 x_refsource_MISC
https://hackerone.com/reports/1204320 x_refsource_MISC
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22249.json x_refsource_CONFIRM