CVE-2021-22240

CVSS 4.2 MEDIUMEPSS 0.7%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.2EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

05 Aug 2021Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

GitLab · GitLab EE

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22240.json https://gitlab.com/gitlab-org/gitlab/-/issues/327641 https://hackerone.com/reports/1166566