Affected GitLab Versions:Īccording to the report, this unauthenticated RCE vulnerability CVE-2021-22205 affects all versions of GitLab (both Enterprise Edition (EE) and Community Edition (CE)) lower than v13.8.8. However, later in Sep 21, 2021, the CVSS score was revised to 10.0 and made the vulnerability to unauthenticated remote code execution vulnerability from authenticated. The vulnerability was initially tracked as CVE-2021-22205 and assigned a CVSSv3 score of 9.9 in Apr 14, 2021. A remote attacker could execute arbitrary commands as the git user due to ExifTool’s mishandling of DjVu files, an issue that was later assigned CVE-2021-22204.” Rapid 7 research team has shared the full technical root cause analysis of the vulnerability here. “GitLab described the issue as an authenticated vulnerability that was the result of passing user-provided images to the service’s embedded version of ExifTool. How To Fix CVE-2021-22205, Unauthenticated RCE Vulnerability In GitLab?.

CVE-2021-22205 Patched Versions Of GitLab.

Exiftool vulnerability