CVE-2021-39895
published 2021-11-05CVE-2021-39895: In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner…
PriorityP420medium4.5CVSS 3.1
AVNACLPRHUIRSUCHINAN
EPSS
0.98%
58.0th percentile
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.2.0 < 14.2.5 | 14.2.5 |
| gitlab | gitlab | >= 8.0.0 < 14.1.7 | 14.1.7 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.14.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:P/I:N/A:N
osv4.5MEDIUM
vendor_debian6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c3rv-jv45-94rx: In all versions of GitLab CE/EE since version 8
ghsa_unreviewed·2022-05-24
CVE-2021-39895 [MEDIUM] GHSA-c3rv-jv45-94rx: In all versions of GitLab CE/EE since version 8
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.
OSV
CVE-2021-39895: In all versions of GitLab CE/EE since version 8
osv·2021-11-05·CVSS 4.5
CVE-2021-39895 [MEDIUM] CVE-2021-39895: In all versions of GitLab CE/EE since version 8
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.
GitLab
CVE-2021-39895: In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting
vendor_gitlab·2021-11-05·CVSS 6.0
CVE-2021-39895 [MEDIUM] CVE-2021-39895: In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting
CVE-2021-39895: In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.
Debian
CVE-2021-39895: gitlab - In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipel...
vendor_debian·2021·CVSS 6.0
CVE-2021-39895 [MEDIUM] CVE-2021-39895: gitlab - In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipel...
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39895.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/337824https://hackerone.com/reports/1272535https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39895.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/337824https://hackerone.com/reports/1272535
2021-11-05
Published