Lucene search

GoogleOSV:BIT-GITLAB-2021-22243

HistoryMar 06, 2024 - 11:19 a.m.

BIT-gitlab-2021-22243

2024-03-0611:19:19

Google

osv.dev

gitlab

ce/ee

invite url

access

group

security vulnerability

software

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

23.0%

JSON

Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.

CPENameOperatorVersion
gitlablt14.1.2
gitlabge14.0.0
gitlablt13.12.9
gitlablt14.0.7
gitlabge7.10.0
gitlabge14.1.0

Name	Operator	Version
gitlab	lt	14.1.2
gitlab	ge	14.0.0
gitlab	lt	13.12.9
gitlab	lt	14.0.7
gitlab	ge	7.10.0
gitlab	ge	14.1.0

References

gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22243.json

gitlab.com/gitlab-org/gitlab/-/issues/325934

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

23.0%

JSON

Related for OSV:BIT-GITLAB-2021-22243