In CISA KEV6.8 Medium
CVE-2021-22175
GitLab Server-Side Request Forgery (SSRF) Vulnerability
Status
- Exploited in the wild
- In CISA KEV since 18 Feb
Federal deadlineWed 11 Mar, 23:59 UTC
Passed 227 days ago
CISA KEV · added 18 Feb
Exploit probabilityEPSSchecked 25 Oct
53%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
6.8Medium
Description NVD
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 19 Feb · 15:10 UTC | The Hacker News | ThreatsDay Bulletin: OpenSSL RCE, Foxit 0-Days, Copilot Leak, AI Password Flaws & 20+ Stories |
| Thu 19 Feb · 15:45 UTC | Security Affairs | U.S. CISA adds Dell RecoverPoint and GitLab flaws to its Known Exploited Vulnerabilities catalog |
- U.S. CISA adds Dell RecoverPoint and GitLab flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
- ThreatsDay Bulletin: OpenSSL RCE, Foxit 0-Days, Copilot Leak, AI Password Flaws & 20+ StoriesThe Hacker News · first in our coverage · mentions it in passing