CVE-2021-39891
published 2021-10-05CVE-2021-39891: In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation…
PriorityP422medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
0.97%
57.6th percentile
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.2.0 < 14.2.5 | 14.2.5 |
| gitlab | gitlab | >= 14.3.0 < 14.3.1 | 14.3.1 |
| gitlab | gitlab | >= 8.0.0 < 14.1.7 | 14.1.7 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv4.9MEDIUM
vendor_debian5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2021-39891: In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impe
vendor_gitlab·2021-10-05·CVSS 5.9
CVE-2021-39891 [MEDIUM] CWE-212 CVE-2021-39891: In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impe
CVE-2021-39891: In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
Debian
CVE-2021-39891: gitlab - In all versions of GitLab CE/EE since version 8.0, access tokens created as part...
vendor_debian·2021·CVSS 5.9
CVE-2021-39891 [MEDIUM] CVE-2021-39891: gitlab - In all versions of GitLab CE/EE since version 8.0, access tokens created as part...
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-xq89-553h-3j4m: In all versions of GitLab CE/EE since version 8
ghsa_unreviewed·2022-05-24
CVE-2021-39891 [MEDIUM] CWE-863 GHSA-xq89-553h-3j4m: In all versions of GitLab CE/EE since version 8
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
OSV
CVE-2021-39891: In all versions of GitLab CE/EE since version 8
osv·2021-10-05·CVSS 4.9
CVE-2021-39891 [MEDIUM] CVE-2021-39891: In all versions of GitLab CE/EE since version 8
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-10-05
Published