{"id":"CVE-2021-22175","published":"2021-06-11T16:15:09Z","modified":"2026-10-01T19:17:14Z","title":"GitLab Server-Side Request Forgery (SSRF) Vulnerability","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"description":{"text":"When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled","provenance":"source","from":"NVD"},"summary":{"text":"A server-side request forgery flaw in the GitLab component handling webhook requests to the internal network allows the request target to be manipulated. An unauthenticated attacker over the network can exploit it, even on instances with registration disabled, provided that requests to the internal network for webhooks are enabled.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:17Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.53372,"percentile":0.98987,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2026-02-18","dueDate":"2026-03-11","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json ; https://nvd.nist.gov/vuln/detail/CVE-2021-22175","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-11","exploitedFirstSeen":"2025-03-11","ransomware":false,"evidence":[{"url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","date":"2025-03-11"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2021-22175","date":"2026-01-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-02-18"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json","tags":["Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/294178","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://hackerone.com/reports/1059596","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json","tags":["Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/294178","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://hackerone.com/reports/1059596","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated SSRF via public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"a server-side request forgery vulnerability in GitLab affecting all versions","start":64,"end":140}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: SSRF proxies requests into internal network","mappingType":"primary_impact","evidence":[{"from":"description","quote":"requests to the internal network for webhooks are enabled","start":5,"end":62}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9321","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9321","exploited":true,"exploitedSince":"2026-02-18","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2021-22175","name":"GitLab CI Lint API - Server-Side Request Forgery","severity":"high","path":"http/cves/2021/CVE-2021-22175.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22175.yaml"}],"provenance":"source"},"exploitRefs":["https://gitlab.com/gitlab-org/gitlab/-/issues/294178"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1090"],"provenance":"ai"}],"timeline":[{"date":"2021-06-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22175","provenance":"source"},{"date":"2025-03-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","provenance":"source"},{"date":"2026-02-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-02-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9321","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1713},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 600 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.8,"detail":"percentile 0.9899"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-gitlab-gitlab-cwe-918"}}