CVE-2021-22192

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.

Affected

GitLab

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GITLAB

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

13.11% chance of exploitation in the next 30 days, 96th percentile

Published

2021-03-24

Updated

2024-08-03

Proof-of-concept exploits (2)

• EXP-Docs/CVE-2021-2219238★ · 2023-01-24
• lyy289065406/CVE-2021-2219238★ · 2023-01-24

Exploit collections (1)

• Gitlab Kramdown RCE（CVE-2021-22192）.mdtzwlhack/Vulnerability

Security advisories

• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22192.json
• https://hackerone.com/reports/1125425

References

• CVE Record
• NVD entry

Related

• CVE-2019-15588
• CVE-2019-5475
• CVE-2020-13277
• CVE-2020-13933