漏洞描述
GitLab CE/EE versions starting from 10.5 are susceptible to a server-side request forgery vulnerability when requests to the internal network for webhooks are enabled, even on a GitLab instance where registration is limited. The same vulnerability actually spans multiple CVEs, due to similar reports that were fixed across separate patches. These CVEs are: - CVE-2021-39935 - CVE-2021-22214 - CVE-2021-22175
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-22214↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-39935↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-22175↗vin01.github.iohttps://vin01.github.io/piptagole/gitlab/ssrf/security/2021/06/15/gitlab-ssrf.html↗docs.gitlab.comhttps://docs.gitlab.com/ee/api/lint.html↗