SWSandworm Watch
target entity

Community and Enterprise Editions

2 source-linked records in the current knowledge graph.

high

CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2021-39935EPSS 35.6%Community and Enterprise EditionsGitLab
CISA KEV ↗ · unattributed attribution
high

CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files. Required action: Apply updates per vendor instructions.

CVE-2021-22205EPSS 99.7%Community and Enterprise EditionsGitLab
CISA KEV ↗ · unattributed attribution