Remote code execution in GitLab
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2021-22192 |
| CWE-ID | CWE-284 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software Subscribe |
Gitlab Community Edition Universal components / Libraries / Software for developers GitLab Enterprise Edition Universal components / Libraries / Software for developers |
| Vendor | GitLab, Inc |
Security Bulletin
This security bulletin contains information about 1 vulnerabilities.
Updated: 26.03.2021
Assigned CVE-ID.
1) Improper access control
EUVDB-ID: #VU51624
Risk: Medium
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2021-22192
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: Yes
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the system.
The vulnerability exists due to improper access restrictions. A remote authenticated user can bypass implemented security restrictions and execute arbitrary code on the server via unsafe user-controlled markdown rendering options.
Install updates from vendor's website.
Vulnerable software versionsGitlab Community Edition: 13.2.0 - 13.9.3
GitLab Enterprise Edition: 13.2.0 - 13.9.3
External linkshttp://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
