CVE-2021-22200

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

VendorProductVersions
GitLabGitLab>=12.6, <13.8.7; >=13.9, <13.9.5; >=13.10, <13.10.1

References

Timeline

Published
Apr 2, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-222016.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on CVE-2021-222024.3An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in CVE-2021-222039.8An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 befoCVE-2021-222047.8Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing tCVE-2021-2220510.0An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that CVE-2021-222064.9An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other mainCVE-2021-222076.5Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injectiCVE-2021-222084.3An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change CVE-2021-222097.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokCVE-2021-22219.6Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affectCVE-2021-222105.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GCVE-2021-222114.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances
CVE-2021-22200: High severity, CVSS 7.5 | Vulnix