CVE-2021-39866
published 2021-10-05CVE-2021-39866: A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.95%
56.9th percentile
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 13.6.0 < 14.1.7 | 14.1.7 |
| gitlab | gitlab | >= 14.2.0 < 14.2.5 | 14.2.5 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
osv5.4MEDIUM
vendor_debian5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2021-39866: A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
vendor_gitlab·2021-10-05·CVSS 5.4
CVE-2021-39866 [MEDIUM] CVE-2021-39866: A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
CVE-2021-39866: A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
Debian
CVE-2021-39866: gitlab - A business logic error in the project deletion process in GitLab 13.6 and later ...
vendor_debian·2021·CVSS 5.4
CVE-2021-39866 [MEDIUM] CVE-2021-39866: gitlab - A business logic error in the project deletion process in GitLab 13.6 and later ...
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-87qr-9vj6-hjc5: A business logic error in the project deletion process in GitLab 13
ghsa_unreviewed·2022-05-24
CVE-2021-39866 [MEDIUM] CWE-668 GHSA-87qr-9vj6-hjc5: A business logic error in the project deletion process in GitLab 13
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
OSV
CVE-2021-39866: A business logic error in the project deletion process in GitLab 13
osv·2021-10-05·CVSS 5.4
CVE-2021-39866 [MEDIUM] CVE-2021-39866: A business logic error in the project deletion process in GitLab 13
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39866.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/333175https://hackerone.com/reports/1199561https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39866.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/333175https://hackerone.com/reports/1199561
2021-10-05
Published