Description

Due to a vulnerablility in ExifTool, GitLab was not properly validating image files which resulted in a remote command execution.

Remediation

Upgrade to the latest version of GitLab

References

CVE-2021-22205

RCE when removing metadata with ExifTool

Related Vulnerabilities

WordPress Plugin Kanzu Support Desk-WordPress Helpdesk Remote Code Execution (2.4.6)

Apache Solr Deserialization of untrusted data via jmx.serviceUrl

XML external entity injection (variant)

MobileIron Log4Shell RCE

WordPress Plugin WordPress Download Manager Remote Code Execution (2.7.4)

Severity

High

Classification

CVE-2021-22205 CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Acumonitor Code Execution