CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2021-22180
https://notcve.org/view.php?id=CVE-2021-22180
An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages. Se ha detectado un problema en GitLab que afecta a todas las versiones desde 13.4. Un control de acceso inapropiado permite a usuarios no autorizados acceder a los detalles de las páginas analíticas. • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22180.json https://gitlab.com/gitlab-org/gitlab/-/issues/295662 https://hackerone.com/reports/1064645 • CWE-425: Direct Request ('Forced Browsing') •
CVSS: 5.7EPSS: 0%CPEs: 6EXPL: 0CVE-2021-22194
https://notcve.org/view.php?id=CVE-2021-22194
In all versions of GitLab, marshalled session keys were being stored in Redis. En todas las versiones de GitLab, las claves de sesión marshalled estaban siendo almacenadas en Redis • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22194.json https://gitlab.com/gitlab-org/gitlab/-/issues/262107 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2021-22172
https://notcve.org/view.php?id=CVE-2021-22172
Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page Una autorización inapropiada en GitLab versión 12.8+, permite a un usuario invitado en un proyecto privado visualizar datos de etiquetas que deberían ser inaccesibles en la página de lanzamientos • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22172.json https://gitlab.com/gitlab-org/gitlab/-/issues/212911 https://hackerone.com/reports/833334 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-22169
https://notcve.org/view.php?id=CVE-2021-22169
An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages. Se identificó un problema en GitLab EE versiones 13.4 o posteriores, que filtró la dirección IP interna por medio de mensajes de error • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22169.json https://gitlab.com/gitlab-org/gitlab/-/issues/289930 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 1CVE-2021-22178
https://notcve.org/view.php?id=CVE-2021-22178
An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration. Se ha detectado un problema en GitLab que afecta a todas las versiones a partir de 13.2. Gitlab era vulnerable a un ataque de tipo SRRF por medio de la integración de Prometheus • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22178.json https://gitlab.com/gitlab-org/gitlab/-/issues/284819 https://hackerone.com/reports/1037411 • CWE-918: Server-Side Request Forgery (SSRF) •