CVE-2021-39898
published 2021-11-05CVE-2021-39898: In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.24%
65.7th percentile
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 10.6.0 < 14.1.7 | 14.1.7 |
| gitlab | gitlab | >= 14.2.0 < 14.2.5 | 14.2.5 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
vendor_debian3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2021-39898: In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project whic
vendor_gitlab·2021-11-05·CVSS 3.7
CVE-2021-39898 [LOW] CWE-200 CVE-2021-39898: In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project whic
CVE-2021-39898: In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
Debian
CVE-2021-39898: gitlab - In all versions of GitLab CE/EE since version 10.6, a project export leaks the e...
vendor_debian·2021·CVSS 3.7
CVE-2021-39898 [LOW] CVE-2021-39898: gitlab - In all versions of GitLab CE/EE since version 10.6, a project export leaks the e...
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
GHSA
GHSA-wjpf-p2m9-5wmv: In all versions of GitLab CE/EE since version 10
ghsa_unreviewed·2022-05-24
CVE-2021-39898 [MEDIUM] CWE-668 GHSA-wjpf-p2m9-5wmv: In all versions of GitLab CE/EE since version 10
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
OSV
CVE-2021-39898: In all versions of GitLab CE/EE since version 10
osv·2021-11-05·CVSS 5.3
CVE-2021-39898 [MEDIUM] CVE-2021-39898: In all versions of GitLab CE/EE since version 10
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39898.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/33734https://hackerone.com/reports/698068https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39898.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/33734https://hackerone.com/reports/698068
2021-11-05
Published