CVE-2021-22257

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=14.0, <14.0.9; >=14.1, <14.1.4; >=14.2, <14.2.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22257.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/23832Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22257.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/23832Broken Link

Timeline

Published: Oct 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-222584.3The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses CVE-2021-222596.5A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.CVE-2021-22264.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are CVE-2021-222605.4A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all CVE-2021-222614.8A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions st CVE-2021-222624.3Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all vers CVE-2021-222636.5An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222646.5An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222675.9Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0 CVE-2021-22278.1Vulnerability in the Oracle Cash Management product of Oracle E-Business Suite (component: Bank Account Transfer). Supported versions that a CVE-2021-222729.4The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to CVE-2021-222758.6Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic progra