CVE-2021-39896 — Gitlab vulnerability

5 documents5 sources
Severity
3.8LOWNVD
EPSS
0.2%
top 58.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedOct 4
Latest updateMay 24

Description

In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NExploitability: 1.2 | Impact: 2.5

Affected Packages5 packages

▶NVDgitlab/gitlab8.0.0 — 14.1.7+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=14.2, <14.2.5, >=14.3, <14.3.1, >=8.0, <14.1.7+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-4ccf-v4wp-c858: In all versions of GitLab CE/EE since version 8↗2022-05-24
▶
OSV
CVE-2021-39896: In all versions of GitLab CE/EE since version 8↗2021-10-04
▶

📋Vendor Advisories

2
GitLab
CVE-2021-39896: In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged i↗2021-10-04
▶
Debian
CVE-2021-39896: gitlab - In all versions of GitLab CE/EE since version 8.0, when an admin uses the impers...↗2021
▶