{"id":18699,"date":"2021-11-23T07:19:59","date_gmt":"2021-11-23T07:19:59","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=18699"},"modified":"2026-04-17T18:07:45","modified_gmt":"2026-04-17T18:07:45","slug":"gitlab-remote-command-execution-vulnerability-cve-2021-22205-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/gitlab-remote-command-execution-vulnerability-cve-2021-22205-threat-alert\/","title":{"rendered":"GitLab Remote Command Execution Vulnerability (CVE-2021-22205) Threat Alert"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Recently, NSFOCUS monitored that researchers disclosed the exploitation program of GitLab remote command execution vulnerability (CVE-2021-22205), and found that the existence of unauthorized endpoints in GitLab cause the vulnerability exploitable without authentication. Both Community Edition (CE) and Enterprise Edition (EE) are affected. On April 15, GitLab official released a security update to fix the GitLab command execution vulnerability (CVE-2021-22205). Because ExifTool in GitLab improperly handle the extension of the incoming image file, which can allow the attacker to execute arbitrary commands on the target server by uploading specially-crafted malicious images. CVSS Score: 9.9. At present, it has been used in the wild. The affected users please take measures for protection as soon as possible.<\/p>\n\n\n\n

GitLab is an open-source project for warehouse management systems developed by GitLab Inc.. Using Git as a code management tool can access public or private projects via the Web interface.<\/p>\n\n\n\n

Reference link: https:\/\/about.gitlab.com\/releases\/2021\/04\/14\/security-release-gitlab-13-10-3-released\/<\/a><\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected Versions<\/strong><\/p>\n\n\n\n