CVE-2021-39916 — Authorization Bypass Through User-Controlled Key in Gitlab

CWE-639 — Authorization Bypass Through User-Controlled KeyCWE-287 — Improper Authentication5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 48.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedDec 13
Latest updateDec 14

Description

Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶NVDgitlab/gitlab14.1.0 — 14.3.6+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=14.1, <14.3.6, >=14.4, <14.4.4, >=14.5, <14.5.2+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-cxxv-5c8r-2cfh: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat↗2021-12-14
▶
OSV
CVE-2021-39916: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat↗2021-12-13
▶

📋Vendor Advisories

2
GitLab
CVE-2021-39916: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat↗2021-12-13
▶
Debian
CVE-2021-39916: gitlab - Lack of an access control check in the External Status Check feature allowed any...↗2021
▶