The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 8.9.0 (including) | 14.0.9 (excluding) |
| Gitlab | Gitlab | 14.1.0 (including) | 14.1.4 (excluding) |
| Gitlab | Gitlab | 14.2.0 (including) | 14.2.2 (excluding) |
| Gitlab | Ubuntu | esm-apps-legacy/xenial | * |
| Gitlab | Ubuntu | esm-apps/xenial | * |
| Gitlab | Ubuntu | xenial | * |
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22258.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/24231
- https://hackerone.com/reports/410436
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22258.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/24231
- https://hackerone.com/reports/410436