CVE-2021-39894
published 2021-10-05CVE-2021-39894: In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.59%
44.0th percentile
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.2.0 < 14.2.5 | 14.2.5 |
| gitlab | gitlab | >= 8.0.0 < 14.1.7 | 14.1.7 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
osv5.4MEDIUM
vendor_debian5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2021-39894: In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit
vendor_gitlab·2021-10-05·CVSS 5.4
CVE-2021-39894 [MEDIUM] CWE-918 CVE-2021-39894: In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit
CVE-2021-39894: In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
Debian
CVE-2021-39894: gitlab - In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability...
vendor_debian·2021·CVSS 5.4
CVE-2021-39894 [MEDIUM] CVE-2021-39894: gitlab - In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability...
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-h93h-vj2c-pxf9: In all versions of GitLab CE/EE since version 8
ghsa_unreviewed·2022-05-24
CVE-2021-39894 [MEDIUM] CWE-918 GHSA-h93h-vj2c-pxf9: In all versions of GitLab CE/EE since version 8
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
OSV
CVE-2021-39894: In all versions of GitLab CE/EE since version 8
osv·2021-10-05·CVSS 5.4
CVE-2021-39894 [MEDIUM] CVE-2021-39894: In all versions of GitLab CE/EE since version 8
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-10-05
Published