CVE-2021-22208
Vulnerability from cvelistv5
Published
2021-05-06 13:35
Modified
2024-08-03 18:37
Severity
Summary
An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update.
References
Source | URL | Tags |
---|---|---|
cve@gitlab.com | https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22208.json | Vendor Advisory |
cve@gitlab.com | https://gitlab.com/gitlab-org/gitlab/-/issues/301212 | Broken Link |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T18:37:18.290Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/301212" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22208.json" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "GitLab", "vendor": "GitLab", "versions": [ { "status": "affected", "version": "\u003e=13.5, \u003c13.9.7" } ] } ], "credits": [ { "lang": "en", "value": "This vulnerability has been discovered internally by the GitLab team." } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "description": "Missing authorization in GitLab", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2021-05-06T13:35:17", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/301212" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22208.json" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@gitlab.com", "ID": "CVE-2021-22208", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "GitLab", "version": { "version_data": [ { "version_value": "\u003e=13.5, \u003c13.9.7" } ] } } ] }, "vendor_name": "GitLab" } ] } }, "credit": [ { "lang": "eng", "value": "This vulnerability has been discovered internally by the GitLab team." } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Missing authorization in GitLab" } ] } ] }, "references": { "reference_data": [ { "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/301212", "refsource": "MISC", "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/301212" }, { "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22208.json", "refsource": "CONFIRM", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22208.json" } ] } } } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2021-22208", "datePublished": "2021-05-06T13:35:17", "dateReserved": "2021-01-05T00:00:00", "dateUpdated": "2024-08-03T18:37:18.290Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2021-22208\",\"sourceIdentifier\":\"cve@gitlab.com\",\"published\":\"2021-05-06T14:15:07.983\",\"lastModified\":\"2022-06-28T14:11:45.273\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update.\"},{\"lang\":\"es\",\"value\":\"Se ha detectado un problema en GitLab que afecta a las versiones que comienzan con 13.5 hasta 13.9.7.\u0026#xa0;Una comprobaci\u00f3n inapropiada de permisos podr\u00eda permitir el cambio de la marca de tiempo para la creaci\u00f3n o actualizaci\u00f3n de problemas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4},{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"13.5.0\",\"versionEndExcluding\":\"13.9.7\",\"matchCriteriaId\":\"4F9BD936-EA52-4482-AECD-F40C34C90E5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"13.5.0\",\"versionEndExcluding\":\"13.9.7\",\"matchCriteriaId\":\"000CBC82-0447-4454-B24D-DF805404E5C9\"}]}]}],\"references\":[{\"url\":\"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22208.json\",\"source\":\"cve@gitlab.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://gitlab.com/gitlab-org/gitlab/-/issues/301212\",\"source\":\"cve@gitlab.com\",\"tags\":[\"Broken Link\"]}]}}" } }
Loading...