CVE-2021-22214

CVE-2021-22214 Gitlab CI Lint API 未承認 SSRF 脆弱性 CVE-2021-22214 本文およびツールは技術共有のみを目的としており、不正な目的での使用は固く禁じられております。違反した場合、一切の結果は自己責任となります。 使用方法 ヘルプ root@kitploit: $ python3 gitlabssrf.py =============================================================== / | | | | | / / | | | | | | || | | | | | | | | | | | ...

CVE-2021-22214

CVE-2021-22214 説明 - CVE-2021-22214のPoC: Gitlab CI Lint APIの未承認SSRF脆弱性 - 作成者: antx, 作成日: 2021-11-01. 詳細 - 内部ネットワークへのWebhookリクエストが有効な場合、GitLab CE/EE（バージョン10.5以降のすべてのバージョンに影響）において、登録が制限されているGitLabインスタンスでも、認証されていない攻撃者がサーバーサイドリクエストフォージェリ（SSRF）脆弱性を悪用できる可能性があります。 CVE深刻度 - attackComplexity: HIGH -...

GitLab-SSRF-CVE-2021-22214

CVE-2021-22214 CVE-2021-22214 的 POC：Gitlab SSRF 描述 远程 GitLab 安装中存在一个服务器端请求伪造（SSRF）漏洞，原因是内部网络的 webhook 被启用。远程未认证的攻击者可以利用一个注册受限的 GitLab 实例，使其向攻击者选择的任意域名发起 HTTP 请求。 用法 Python 代码 root@kitploit: usage: python3 GitLabSSRF.py Curl 命令 root@kitploit: curl -s –show-error -H 'Content-Type: application/json'...

GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API...

Linux Distros Unpatched Vulnerability : CVE-2021-39935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all version...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

The vulnerability of the CI Lint API component of the software platform based on git for collaborative code development in GitLab allows a attacker to perform an SSRF attack.

The vulnerability of the CI Lint API component of the software platform based on Git for collaborative code development on GitLab is related to insufficient testing of server-side requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

VulnCheck KEV: CVE-2021-39935

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API...

PT-2025-1718 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.0 through 17.6.3 GitLab CE/EE versions 17.7 through 17.7.2 GitLab CE/EE versions 17.8 through 17.8.0 Description: An issue has been discovered in GitLab CE/EE that affects users with a developer role, allowing them to...

BIT-GITLAB-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

CVE-2021-39935

Removed by vendor...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

PT-2021-22774

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.5 through 14.3.5 GitLab CE/EE versions 14.4 through 14.4.3 GitLab CE/EE versions 14.5 through 14.5.1 Description An issue has been discovered in GitLab CE/EE where unauthorized external users could perform Server Side...

FreeBSD : Gitlab -- Multiple Vulnerabilities (5f52d646-c31f-11eb-8dcf-001b217b3468)

Gitlab reports : Stealing GitLab OAuth access tokens using XSLeaks in Safari Denial of service through recursive triggered pipelines Unauthenticated CI lint API may lead to information disclosure and SSRF Server-side DoS through rendering crafted Markdown documents Issue and merge request length...