CVE report
CVE-2021-22205criticalKEV
GitLab CE/EE - Remote Code Execution
Events 90d
114
Distinct IPs
55
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2021-22205 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /users/sign_in
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 22 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2021-22205
- 88.210.63.5721 eventsUkraine· FOP Dmytro Nedilskyi
- 161.97.86.8219 eventsFrance
- 69.197.164.22214 eventsUnited States· WholeSale Internet, Inc.
- 179.43.163.264 eventsSwitzerland· Private Layer INC
- 185.194.205.184 eventsBrazil· QNAX LTDA
- 101.36.125.583 eventsHong Kong· UCLOUD INFORMATION TECHNOLOGY HK LIMITED
- 66.228.53.1051 eventsUnited States
- 172.105.23.1801 eventsCanada
- 165.22.150.1721 eventsUnited States
- 147.182.179.261 eventsUnited States
- 167.99.151.1641 eventsUnited States
- 134.122.36.2551 eventsCanada
- 139.177.205.431 eventsUnited States
- 170.64.146.1801 eventsAustralia
- 74.207.243.861 eventsUnited States
- 159.89.55.591 eventsUnited States
- 165.227.23.21 eventsUnited States
- 192.81.131.1401 eventsUnited States
- 194.195.211.1991 eventsUnited States
- 50.116.30.1891 eventsUnited States
- 157.230.180.2261 eventsUnited States
- 165.227.21.391 eventsUnited States
- 74.207.252.1091 eventsUnited States
- 45.79.207.141 eventsUnited States
- 66.228.47.401 eventsUnited States
- 45.79.103.441 eventsUnited States
- 178.128.179.481 eventsUnited States
- 134.209.56.51 eventsUnited States
- 74.207.254.1271 eventsUnited States
- 23.239.12.2141 eventsUnited States
Top networks the attempts come from
- AS14061 DigitalOcean, LLC26 IPs · 26 ev
- AS63949 Akamai Connected Cloud22 IPs · 22 ev
- AS211736 FOP Dmytro Nedilskyi1 IPs · 21 ev
- AS51167 Contabo GmbH1 IPs · 19 ev
- AS32097 WholeSale Internet, Inc.1 IPs · 14 ev
- AS51852 Private Layer INC1 IPs · 4 ev
- AS268581 QNAX LTDA1 IPs · 4 ev
- AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED1 IPs · 3 ev
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
ja4h: ge11nn0400_88d30a62b7adja4h: ge11nn15en_a743836884dfja4h: ge11nn0300_0db47b7d240dja4h: ge11nn06en_e4773a62bf4cja4h: ge11nn0300_dedeb29cc523ja4h: ge11nn0500_ac5b6e4e5c5dja4: t13i250900_b78ed14e2fd0_e7c285222651ja4: t13i3112h1_e8f1e7e78f70_d339722ba4afja4: t13i311000_e8f1e7e78f70_d41ae481755eja4: t13i190800_9dc949149365_97f8aa674fd9ja4: t13i131000_f57a46bbacb6_ab7e3b40a677
Sample request paths observed
- /users/sign_in