An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2
GitLab · GitLab
GitLab CE/EE contains a flaw in its GraphQL API that affects private instances with restricted sign-ups. The issue is present in the affected GitLab releases covered by the advisory, which span versions 13.0 through 14.8.2. An unauthenticated attacker with network access to the instance can send GraphQL API requests to enumerate existing user accounts, and no user interaction or prior authentication is required. The exposure is limited to instances that restrict sign-ups, and the attack depends on the GraphQL endpoint being reachable.
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 20 months after disclosure. Public exploit code (Metasploit) was available 31 days before disclosure.
- Public exploit codeMetasploit31 days before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+20 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 3 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.