CVE-2021-39916
published 2021-12-13CVE-2021-39916: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.81%
52.3th percentile
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.1.0 < 14.3.6 | 14.3.6 |
| gitlab | gitlab | >= 14.4.0 < 14.4.4 | 14.4.4 |
| gitlab | gitlab | >= 14.5.0 < 14.5.2 | 14.5.2 |
| gitlab | gitlab_ee | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cxxv-5c8r-2cfh: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat
ghsa_unreviewed·2021-12-14
CVE-2021-39916 [MEDIUM] CWE-287 GHSA-cxxv-5c8r-2cfh: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
OSV
CVE-2021-39916: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat
osv·2021-12-13·CVSS 4.3
CVE-2021-39916 [MEDIUM] CVE-2021-39916: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
GitLab
CVE-2021-39916: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat
vendor_gitlab·2021-12-13·CVSS 4.3
CVE-2021-39916 [MEDIUM] CWE-639 CVE-2021-39916: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Stat
CVE-2021-39916: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
Debian
CVE-2021-39916: gitlab - Lack of an access control check in the External Status Check feature allowed any...
vendor_debian·2021·CVSS 4.3
CVE-2021-39916 [MEDIUM] CVE-2021-39916: gitlab - Lack of an access control check in the External Status Check feature allowed any...
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39916.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/343379https://hackerone.com/reports/1372216https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39916.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/343379https://hackerone.com/reports/1372216
2021-12-13
Published