CVE-2021-22219

2021-06-0800:00:00

ubuntu.com

gitlab

sensitive information

exposure

log files

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

34.6%

JSON

All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions
starting from 13.11 before 13.11.5, and all versions starting from 13.12
before 13.12.2 allow a high privilege user to obtain sensitive information
from log files because the sensitive information was not correctly
registered for log masking.