CVE-2021-22175
Summary
| CVE | CVE-2021-22175 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-06-11 16:15:00 UTC |
| Updated | 2021-06-21 18:44:00 UTC |
| Description | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled |
Risk And Classification
EPSS: 0.533720000 probability, percentile 0.988780000 (date 2026-07-22)
CISA KEV: Listed on 2026-02-18; due 2026-03-11; ransomware use Unknown
Problem Types: CWE-918
CISA Known Exploited Vulnerability
| Vendor | GitLab |
|---|---|
| Product | GitLab |
| Name | GitLab Server-Side Request Forgery (SSRF) Vulnerability |
| Required Action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| Notes | https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json ; https://nvd.nist.gov/vuln/detail/CVE-2021-22175 |
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| HackerOne | MISC | hackerone.com | |
| 2021/CVE-2021-22175.json · master · GitLab.org / cves · GitLab | CONFIRM | gitlab.com | |
| Not Found | MISC | gitlab.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
Vendor Comments And Credit
Discovery Credit
LEGACY: Thanks [@myster](https://hackerone.com/myster?type=user) for reporting this vulnerability through our HackerOne bug bounty program
There are currently no legacy QID mappings associated with this CVE.