CVE-2021-22175KEV · OVERDUECWE-918ssrf

GitLab Server-Side Request Forgery (SSRF) Vulnerability

Medium · published June 11, 2021

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.

227
days past CISA
deadline
CVSS v3.1
6.8
EPSS
53%
Percentile
99.0
In the wild
Confirmed
What it is

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.53372 · 99.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2021-06-11T20:15Z
KEV added
2026-02-18 · due 2026-03-11
Affected products (6)
ProductVersionsFixed in
gitlab/gitlab≥ 10.5.0, < 13.6.713.6.7
gitlab/gitlab≥ 10.5.0, < 13.6.713.6.7
gitlab/gitlab≥ 13.7.0, < 13.7.713.7.7
gitlab/gitlab≥ 13.7.0, < 13.7.713.7.7
gitlab/gitlab≥ 13.8.0, < 13.8.413.8.4
gitlab/gitlab≥ 13.8.0, < 13.8.413.8.4
References (7)
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json · [email protected]https://gitlab.com/gitlab-org/gitlab/-/issues/294178 · [email protected]https://hackerone.com/reports/1059596 · [email protected]https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json · af854a3a-2127-422b-91ae-364da2661108https://gitlab.com/gitlab-org/gitlab/-/issues/294178 · af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/1059596 · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 FEB 00:00Z
    Added to CISA KEV — remediate by Mar 11
    kev
  • 11 JUN 15:30Z
    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5…
    cvelistv5