CVE-2021-39918 — Incorrect Authorization in Gitlab

CWE-863 — Incorrect Authorization5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 54.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedDec 13
Latest updateDec 14

Description

Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶NVDgitlab/gitlab11.1.0 — 14.3.6+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=11.1, <14.3.6, >=14.4, <14.4.4, >=14.5, <14.5.2+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-9mhg-328h-2hfr: Incorrect Authorization in GitLab EE affecting all versions starting from 11↗2021-12-14
▶
OSV
CVE-2021-39918: Incorrect Authorization in GitLab EE affecting all versions starting from 11↗2021-12-13
▶

📋Vendor Advisories

2
GitLab
CVE-2021-39918: Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versi↗2021-12-13
▶
Debian
CVE-2021-39918: gitlab - Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 b...↗2021
▶