LiveActive security incident?Get immediate response
CVE Record

CVE-2021-22245: Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make sev...

Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view

LowCVSS 2.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a low-severity GitLab issue where a highly privileged attacker could abuse improper commit-author validation to make several project pages unavailable. The main business impact is localized disruption to project visibility, not data theft or code execution, based on the provided CVSS and description.

Executive priority

Treat as routine patching unless affected GitLab versions are internet-accessible and widely administered. The issue has low CVSS severity and requires high privileges, but it can disrupt project workflows.

Technical view

CVE-2021-22245 affects GitLab CE/EE versions before 13.12.9, 14.0 before 14.0.7, and 14.1 before 14.1.2. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L, indicating network reachability, high privileges required, and low availability impact.

Likely exposure

Exposure is limited to GitLab CE/EE deployments running the listed affected versions. The CVSS vector requires high privileges, so risk is most relevant where privileged project or instance users are not tightly controlled.

Exploitation context

The provided sources do not show KEV listing or active exploitation. Public references include GitLab and HackerOne records, but the bundle only supports a denial-of-availability impact against project pages, not broader compromise.

Researcher notes

Focus validation on version exposure, privilege model, and availability impact. The bundle does not provide exploit details, confirmed exploitation, or deeper root-cause data beyond improper commit-author validation.

Mitigation direction

  • Upgrade GitLab to 13.12.9, 14.0.7, 14.1.2, or later applicable versions.
  • Review GitLab vendor guidance linked in the CVE references.
  • Restrict high-privilege GitLab roles to users with a clear operational need.
  • Monitor affected projects for page-view failures until upgraded.

Validation and detection

  • Inventory GitLab CE/EE version across all self-managed instances.
  • Compare versions against the affected ranges in the CVE record.
  • Review privileged project and instance user assignments.
  • Check whether project pages become unavailable in affected repositories.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-22245 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.7CVSS 3.1LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L1.21.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

2.7Low
CVSS 3.1 vector shape for CVE-2021-22245Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GitLabGitLab<13.12.9, >=14.0, <14.0.7, >=14.1, <14.1.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.