CVE-2021-22258

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=14.2, <14.2.2; >=14.1, <14.1.4; >=8.9, <14.0.9

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22258.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/24231Broken Link
https://hackerone.com/reports/410436Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22258.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/24231Broken Link
https://hackerone.com/reports/410436Permissions Required, Third Party Advisory

Timeline

Published: Oct 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-222596.5A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.CVE-2021-22264.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are CVE-2021-222605.4A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all CVE-2021-222614.8A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions st CVE-2021-222624.3Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all vers CVE-2021-222636.5An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222646.5An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222675.9Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0 CVE-2021-22278.1Vulnerability in the Oracle Cash Management product of Oracle E-Business Suite (component: Bank Account Transfer). Supported versions that a CVE-2021-222729.4The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to CVE-2021-222758.6Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic progra CVE-2021-222765.5The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.