6.6

CVE-2021-22237

Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ Gitlab SwEditioncommunity Version >= 13.1.0 < 13.12.9
Gitlab ≫ Gitlab SwEditionenterprise Version >= 13.1.0 < 13.12.9
Gitlab ≫ Gitlab SwEditioncommunity Version >= 14.0.0 < 14.0.7
Gitlab ≫ Gitlab SwEditionenterprise Version >= 14.0.0 < 14.0.7
Gitlab ≫ Gitlab SwEditioncommunity Version >= 14.1.0 < 14.1.2
Gitlab ≫ Gitlab SwEditionenterprise Version >= 14.1.0 < 14.1.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.393
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
cve@gitlab.com 6.6 0.7 5.9
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-384 Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.