← Back

CVE-2021-22205

nvd nistnuclei
Published: Apr 23, 2021Modified: Oct 24, 2025CISA KEV

JSON object

Loading...
10.0
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 6.0
Source: NVD

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 11.9.0 to 13.8.8
Gitlab
From 13.10.0 to 13.10.3
Gitlab
From 13.9.0 to 13.9.6
Gitlab
From 11.9.0 to 13.8.8
Gitlab
From 13.10.0 to 13.10.3
Gitlab
From 13.9.0 to 13.9.6

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (11)

Source: cve@gitlab.com
ExploitThird Party AdvisoryVDB Entry
Source: cve@gitlab.com
ExploitThird Party AdvisoryVDB Entry
Source: cve@gitlab.com
Vendor Advisory
Source: cve@gitlab.com
Broken Link
Source: cve@gitlab.com
Permissions RequiredThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions RequiredThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.