LiveActive security incident?Get immediate response
CVE Record

CVE-2021-22215: An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to le...

An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw let a GitLab EE project owner see information about members' on-call rotations in other projects. The business issue is confidentiality: incident-response staffing or rotation details could be exposed across project boundaries. The supplied sources do not show public exploitation or operational impact beyond information disclosure.

Executive priority

Prioritize remediation for any affected GitLab EE instance that hosts sensitive incident-response operations or broad internal project access. The issue is high severity but currently lacks supplied evidence of exploitation, so treat it as a confidentiality fix rather than an emergency exploitation response.

Technical view

CVE-2021-22215 affects GitLab EE 13.11 before 13.11.5 and 13.12 before 13.12.2. The CVSS 3.1 score is 7.5, driven by network reachability, low complexity, no user interaction, and high confidentiality impact. The prose describes abuse by a project owner, so access preconditions are not fully clear.

Likely exposure

Exposure is limited to GitLab EE deployments in the listed affected version ranges, especially where users have project-owner roles. GitLab CE or other GitLab versions are not identified as affected in the supplied bundle.

Exploitation context

The bundle does not cite CISA KEV listing, active exploitation, public exploit code, or real-world incident use. Treat exploitation status as unconfirmed. The described attacker position is a project owner seeking on-call rotation information from other projects.

Researcher notes

There is a source tension: the CVSS vector says no privileges required, while the description says a project owner could leak data. Do not assume unauthenticated exploitation from the supplied evidence. Validate affected code paths against GitLab EE version and role boundaries.

Mitigation direction

  • Upgrade GitLab EE outside the affected ranges: 13.11.5+, 13.12.2+, or later supported releases.
  • Check GitLab's issue and CVE record for deployment-specific guidance.
  • Review project-owner assignments and remove unnecessary owner privileges.
  • Limit access to on-call rotation data to teams with a valid operational need.

Validation and detection

  • Inventory GitLab EE instances and record exact version numbers.
  • Flag instances running 13.11 before 13.11.5 or 13.12 before 13.12.2.
  • Review project-owner membership in projects using on-call rotations.
  • Check audit logs for unusual access to on-call rotation data, if available.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-22215 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2021-22215Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GitLabGitLab>=13.11, <13.11.5, >=13.12, <13.12.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.