CVE-2021-22175

CRITICAL9.8⚠ KEVEPSS 80.0%

GitLab Server-Side Request Forgery (SSRF) Vulnerability

發布日:2024/3/6修改日:2026/2/19加入 CISA KEV 日:2026/2/18

描述

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

受影響套件(1)

  • Bitnami/gitlab>= 10.5.0, < 13.6.7, >= 13.7.0, < 13.7.7, >= 13.8.0, < 13.8.4

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(5)