{"id":"CVE-2021-22175","title":"When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab inst…","summary":"When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab inst…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"gitlab","product":"gitlab","affected":["gitlab >= 10.5.0, < 13.6.7","gitlab >= 13.7.0, < 13.7.7","gitlab >= 13.8.0, < 13.8.4"],"patched":["gitlab 13.8.4"],"published":"2021-06-11","updated":"2026-10-01","sourceUpdated":"2026-10-01T19:17:14.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-22175","references":[{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json","label":"cve@gitlab.com"},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/294178","label":"cve@gitlab.com"},{"url":"https://hackerone.com/reports/1059596","label":"cve@gitlab.com"},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/294178","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://hackerone.com/reports/1059596","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available","cve.org"],"epss":0.53372,"epssPercentile":0.98981,"kev":true,"kevDateAdded":"2026-02-18","kevDueDate":"2026-03-11","kevRansomware":false,"exploited":true,"exploits":{"nuclei":["CVE-2021-22175"],"checkedAt":"2026-10-27T16:39:23.954Z"},"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-02-19T04:55:37.706988Z"},"ingestedAt":"2026-10-01T18:55:42.393Z","slug":"CVE-2021-22175","body":"## Overview\n\nWhen requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled\n\n## Affected\n\n- `gitlab >= 10.5.0, < 13.6.7`\n- `gitlab >= 13.7.0, < 13.7.7`\n- `gitlab >= 13.8.0, < 13.8.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gitlab 13.8.4`","depth":"midnight","depthScore":73,"depthScoreParts":{"impact":37.4,"likelihood":10.7,"exploitation":25,"ransomware":0},"changes":[]}