CVE-2021-22237

MEDIUM

GitLab <13.12.9, <14.0.7, <14.1.2 - Info Disclosure

Title source: llm
STIX 2.1

Description

Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2

References (2)

Core 2
Core References

Scores

CVSS v3 6.6
EPSS 0.0082
EPSS Percentile 52.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-384
Status published
Products (1)
gitlab/gitlab 13.1.0 - 13.12.9 (2 CPE variants)
Published Aug 25, 2021
Tracked Since Feb 18, 2026