www.cybersecurity-help.cz
Open in
urlscan Pro
62.210.13.228
Public Scan
URL:
https://www.cybersecurity-help.cz/vdb/SB2021120905
Submission: On December 11 via api from US — Scanned from FR
Submission: On December 11 via api from US — Scanned from FR
Form analysis 1 forms found in the DOM
GET /vdb/list.php
<form action="/vdb/list.php" method="GET">
<input type="hidden" name="search_line" value="Y">
<div id="custom-search-input">
<div class="input-group col-md-12">
<input type="text" class="form-control input-sm" name="filter[%SEARCH]" value="" placeholder="Search vulnerability database">
<span class="input-group-btn">
<button class="btn btn-sm" type="submit">
<i class="glyphicon glyphicon-search"></i>
</button>
</span>
</div>
</div>
<br>
<div class="form-group">
<div class="kt-checkbox-inline col-lg-2 col-xl-2">
<label class="kt-checkbox">
<input type="checkbox" class="flat" name="filter[EXPLOIT]" value="Y"> With exploit <span></span>
</label>
</div>
<div class="kt-checkbox-inline col-lg-2 col-xl-2">
<label class="kt-checkbox">
<input type="checkbox" class="flat" name="filter[PATCH]" value="Y"> With patch <span></span>
</label>
</div>
</div>
</form>Text Content
Register Login
Toggle navigation
* SaaS Solutions
* Vulnerability Intelligence
* Pricing
* Vulnerabilities
* Blog
* Contact Us
* Career
1. Main
2. Vulnerability Database
With exploit
With patch
MULTIPLE VULNERABILITIES IN GITLAB COMMUNITY EDITION (CE) AND ENTERPRISE EDITION
(EE)
Published: 2021-12-09
*
*
*
*
*
*
*
Risk Medium Patch available YES Number of vulnerabilities 19 CVE-ID
CVE-2021-39944
CVE-2021-39932
CVE-2021-39940
CVE-2021-39930
CVE-2021-39919
CVE-2021-39915
CVE-2021-39937
CVE-2021-39935
CVE-2021-39933
CVE-2021-39934
CVE-2021-39917
CVE-2021-39916
CVE-2021-39941
CVE-2021-39936
CVE-2021-39938
CVE-2021-39918
CVE-2021-39931
CVE-2021-39945
CVE-2021-39910
CWE-ID CWE-264
CWE-20
CWE-200
CWE-284
CWE-918
CWE-400
CWE-285
CWE-840
CWE-79
Exploitation vector Network Public exploit N/A Vulnerable software
Subscribe Gitlab Community Edition
Universal components / Libraries / Software for developers
GitLab Enterprise Edition
Universal components / Libraries / Software for developers
Vendor GitLab, Inc
SECURITY BULLETIN
This security bulletin contains information about 19 vulnerabilities.
1) PERMISSIONS, PRIVILEGES, AND ACCESS CONTROLS
EUVDB-ID: #VU58753
Risk: Medium
CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39944
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
Description
The vulnerability allows a remote authenticated attacker to escalate privileges
on the system.
The vulnerability exists due to application does not properly impose security
restrictions, which leads to security restrictions bypass and privilege
escalation.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 11.0, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5,
11.0.6, 11.1, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7,
11.1.8, 11.2, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7,
11.2.8, 11.3, 11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7,
11.3.8, 11.3.9, 11.3.10, 11.3.11, 11.3.12, 11.3.13, 11.3.14, 11.4, 11.4.0,
11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.4.10,
11.4.11, 11.4.12, 11.4.13, 11.4.14, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4,
11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.5.11, 11.6.0, 11.6.1,
11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.6, 11.6.7, 11.6.8, 11.6.9, 11.6.10,
11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.4, 11.7.5, 11.7.6, 11.7.7, 11.7.8,
11.7.9, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.1, 11.8.2, 11.8.3, 11.8.4,
11.8.5, 11.8.6, 11.8.7, 11.8.8, 11.8.9, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3,
11.9.4, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10, 11.9.11, 11.9.12,
11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.5, 11.10.6, 11.10.7, 11.10.8,
11.11.0, 11.11.1, 11.11.2, 11.11.3, 11.11.4, 11.11.5, 11.11.7, 11.11.8, 12.0.0,
12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.6, 12.0.8, 12.0.9, 12.0.10, 12.0.12,
12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.6, 12.1.8, 12.1.9, 12.1.10,
12.1.11, 12.1.12, 12.1.13, 12.1.14, 12.1.15, 12.1.16, 12.1.17, 12.2.0, 12.2.1,
12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11,
12.2.12, 12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6, 12.3.7, 12.3.8,
12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.4.5, 12.4.6, 12.4.7, 12.4.8,
12.5.0, 12.5.1, 12.5.2, 12.5.3, 12.5.4, 12.5.5, 12.5.6, 12.5.7, 12.5.9, 12.5.10,
12.6.0, 12.6.1, 12.6.2, 12.6.3, 12.6.4, 12.6.6, 12.6.7, 12.6.8, 12.7.0, 12.7.1,
12.7.2, 12.7.4, 12.7.5, 12.7.6, 12.7.7, 12.7.8, 12.7.9, 12.8.0, 12.8.1, 12.8.2,
12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.8, 12.8.9, 12.8.10, 12.9.0, 12.9.1,
12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7, 12.9.8, 12.9.9, 12.9.10,
12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.9, 12.10.10, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1,
13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10,
13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5,
13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11, 13.2.0, 13.2.1, 13.2.2,
13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1,
13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3,
13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5,
13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7,
13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7,
13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0,
14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5,
11.0.6, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.2.0,
11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3.0, 11.3.1,
11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10,
11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5,
11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.5, 11.5.8,
11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.8,
11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.5, 11.7.7,
11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.2, 11.8.3, 11.8.6, 11.8.7,
11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9,
11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.6, 11.10.7,
11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4, 11.11.7, 11.11.8, 12.0.0, 12.0.1,
12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10, 12.0.12, 12.1.1, 12.1.2, 12.1.3,
12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12, 12.1.14, 12.2.0, 12.2.1, 12.2.2,
12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.11, 12.3.0, 12.3.1, 12.3.2,
12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.5, 12.4.8, 12.5.0,
12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0, 12.6.1, 12.6.2, 12.6.4,
12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5, 12.7.9,
12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9, 12.8.10,
12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8, 12.9.10,
12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0,
13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:11.11.8:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) INPUT VALIDATION ERROR
EUVDB-ID: #VU58760
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39932
CWE-ID: CWE-20 - Improper Input Validation
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS)
attack.
The vulnerability exists due to insufficient validation of user-supplied input
in the Diff feature. A remote authenticated attacker can pass specially crafted
input to the application and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 11.0, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5,
11.0.6, 11.1, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7,
11.1.8, 11.2, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7,
11.2.8, 11.3, 11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7,
11.3.8, 11.3.9, 11.3.10, 11.3.11, 11.3.12, 11.3.13, 11.3.14, 11.4, 11.4.0,
11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.4.10,
11.4.11, 11.4.12, 11.4.13, 11.4.14, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4,
11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.5.11, 11.6.0, 11.6.1,
11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.6, 11.6.7, 11.6.8, 11.6.9, 11.6.10,
11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.4, 11.7.5, 11.7.6, 11.7.7, 11.7.8,
11.7.9, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.1, 11.8.2, 11.8.3, 11.8.4,
11.8.5, 11.8.6, 11.8.7, 11.8.8, 11.8.9, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3,
11.9.4, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10, 11.9.11, 11.9.12,
11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.5, 11.10.6, 11.10.7, 11.10.8,
11.11.0, 11.11.1, 11.11.2, 11.11.3, 11.11.4, 11.11.5, 11.11.7, 11.11.8, 12.0.0,
12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.6, 12.0.8, 12.0.9, 12.0.10, 12.0.12,
12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.6, 12.1.8, 12.1.9, 12.1.10,
12.1.11, 12.1.12, 12.1.13, 12.1.14, 12.1.15, 12.1.16, 12.1.17, 12.2.0, 12.2.1,
12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11,
12.2.12, 12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6, 12.3.7, 12.3.8,
12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.4.5, 12.4.6, 12.4.7, 12.4.8,
12.5.0, 12.5.1, 12.5.2, 12.5.3, 12.5.4, 12.5.5, 12.5.6, 12.5.7, 12.5.9, 12.5.10,
12.6.0, 12.6.1, 12.6.2, 12.6.3, 12.6.4, 12.6.6, 12.6.7, 12.6.8, 12.7.0, 12.7.1,
12.7.2, 12.7.4, 12.7.5, 12.7.6, 12.7.7, 12.7.8, 12.7.9, 12.8.0, 12.8.1, 12.8.2,
12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.8, 12.8.9, 12.8.10, 12.9.0, 12.9.1,
12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7, 12.9.8, 12.9.9, 12.9.10,
12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.9, 12.10.10, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1,
13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10,
13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5,
13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11, 13.2.0, 13.2.1, 13.2.2,
13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1,
13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3,
13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5,
13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7,
13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7,
13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0,
14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5,
11.0.6, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.2.0,
11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3.0, 11.3.1,
11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10,
11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5,
11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.5, 11.5.8,
11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.8,
11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.5, 11.7.7,
11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.2, 11.8.3, 11.8.6, 11.8.7,
11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9,
11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.6, 11.10.7,
11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4, 11.11.7, 11.11.8, 12.0.0, 12.0.1,
12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10, 12.0.12, 12.1.1, 12.1.2, 12.1.3,
12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12, 12.1.14, 12.2.0, 12.2.1, 12.2.2,
12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.11, 12.3.0, 12.3.1, 12.3.2,
12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.5, 12.4.8, 12.5.0,
12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0, 12.6.1, 12.6.2, 12.6.4,
12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5, 12.7.9,
12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9, 12.8.10,
12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8, 12.9.10,
12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0,
13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:11.11.8:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) INPUT VALIDATION ERROR
EUVDB-ID: #VU58759
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39940
CWE-ID: CWE-20 - Improper Input Validation
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS)
attack.
The vulnerability exists due to insufficient validation of user-supplied input.
A remote authenticated attacker can pass specially crafted input to the
application and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 13.2.0, 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5,
13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4,
13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1, 13.4.2, 13.4.3, 13.4.4,
13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6,
13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0,
13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0,
13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1,
13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2,
13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5,
13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6,
13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1, 14.0.2, 14.0.3,
14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0, 14.1.1, 14.1.2,
14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.5,
14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2,
14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 13.2.0, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6,
13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6,
13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7,
13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1,
13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3,
13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3,
13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4,
13.9.5, 13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5,
13.11.0, 13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0,
13.12.1, 13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 13.12.12, 13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10,
14.0.11, 14.0.12, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6,
14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7,
14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3,
14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:13.12.11:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) INFORMATION DISCLOSURE
EUVDB-ID: #VU58758
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39930
CWE-ID: CWE-200 - Information Exposure
Exploit availability: No
Description
The vulnerability allows a remote attacker to gain access to potentially
sensitive information.
The vulnerability exists due to missing authorization. A remote authenticated
attacker can gain unauthorized access to sensitive information on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
GitLab Enterprise Edition: 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.5, 12.4.8,
12.5.0, 12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0, 12.6.1, 12.6.2,
12.6.4, 12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5,
12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9,
12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8,
12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0,
13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab-ee:12.4.8:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) INFORMATION DISCLOSURE
EUVDB-ID: #VU58757
Risk: Low
CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39919
CWE-ID: CWE-200 - Information Exposure
Exploit availability: No
Description
The vulnerability allows a local user to gain access to potentially sensitive
information.
The vulnerability exists due to excessive data output by the application in
logs. A local administrator can gain unauthorized access to sensitive
information on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4,
14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.5, 14.2.6, 14.3.0,
14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0,
14.5.1
GitLab Enterprise Edition: 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:14.5.1:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have
authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) IMPROPER ACCESS CONTROL
EUVDB-ID: #VU58756
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39915
CWE-ID: CWE-284 - Improper Access Control
Exploit availability: No
Description
The vulnerability allows a remote attacker to gain unauthorized access to
otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker
can bypass implemented security restrictions and see the names of project access
tokens on arbitrary projects.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 13.0.0, 13.0.1, 13.0.2, 13.0.3, 13.0.4, 13.0.5,
13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10,
13.1.11, 13.2.0, 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8,
13.2.9, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7,
13.3.8, 13.3.9, 13.4.0, 13.4.1, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7,
13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1,
13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3,
13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3,
13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4,
13.9.5, 13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5,
13.11.0, 13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0,
13.12.1, 13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6,
14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5,
14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1,
14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6, 13.0.7,
13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1,
13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0, 13.2.2,
13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1, 13.3.2,
13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2, 13.4.3,
13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5,
13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7,
13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9,
13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0,
13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0, 13.10.1,
13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3, 13.11.4,
13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4, 13.12.5,
13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12, 13.12.13,
13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6,
14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1, 14.1.2,
14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3,
14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5,
14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:13.12.11:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker
via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) PERMISSIONS, PRIVILEGES, AND ACCESS CONTROLS
EUVDB-ID: #VU58755
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39937
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
Description
The vulnerability allows a remote authenticated attacker to escalate privileges
on the system.
The vulnerability exists due to a collision in access memoization logic, which
leads to security restrictions bypass and privilege escalation.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 0.1.5, 0.8.0, 0.9.1, 0.9.4, 0.9.5, 0.9.6, 1.0, 1.0.0,
1.0.1, 1.0.2, 1.1, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 2.0, 2.0.0, 2.1, 2.1.0, 2.2,
2.2.0, 2.3, 2.3.0, 2.3.1, 2.4, 2.4.0, 2.4.1, 2.4.2, 2.5, 2.5.0, 2.6, 2.6.0,
2.6.1, 2.6.2, 2.6.3, 2.7, 2.7.0, 2.8, 2.8.0, 2.8.1, 2.8.2, 2.9, 2.9.0, 2.9.1,
3.0, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1, 3.1.0, 4.0, 4.0.0, 4.1, 4.1.0, 4.2, 4.2.0,
5.0, 5.0.0, 5.0.1, 5.1, 5.1.0, 5.2, 5.2.0, 5.2.1, 5.3, 5.3.0, 5.4, 5.4.0, 5.4.1,
5.4.2, 6.0, 6.0.0, 6.0.1, 6.0.2, 6.1, 6.1.0, 6.2, 6.2.0, 6.2.1, 6.2.2, 6.2.3,
6.2.4, 6.3, 6.3.0, 6.3.1, 6.4, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.5, 6.5.0, 6.5.1,
6.6, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.7, 6.7.0, 6.7.1, 6.7.2, 6.7.3,
6.7.4, 6.7.5, 6.8, 6.8.0, 6.8.1, 6.8.2, 6.9, 6.9.0, 6.9.1, 6.9.2, 7.0, 7.0.0,
7.0.1, 7.1, 7.1.0, 7.1.1, 7.2, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.3, 7.3.0, 7.3.1,
7.3.2, 7.3.3, 7.4, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.4.5, 7.5, 7.5.0, 7.5.1,
7.5.2, 7.5.3, 7.6, 7.6.0, 7.6.1, 7.6.2, 7.6.3, 7.7, 7.7.0, 7.7.1, 7.7.2, 7.8,
7.8.0, 7.8.1, 7.8.2, 7.8.3, 7.8.4, 7.9, 7.9.0, 7.9.1, 7.9.2, 7.9.3, 7.9.4, 7.10,
7.10.0, 7.10.1, 7.10.2, 7.10.3, 7.10.4, 7.10.5, 7.11, 7.11.0, 7.11.1, 7.11.2,
7.11.3, 7.11.4, 7.12, 7.12.0, 7.12.1, 7.12.2, 7.13, 7.13.0, 7.13.1, 7.13.2,
7.13.3, 7.13.4, 7.13.5, 7.14, 7.14.0, 7.14.1, 7.14.2, 7.14.3, 8.0, 8.0.0, 8.0.1,
8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.1, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.2, 8.2.0,
8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.3, 8.3.0, 8.3.1, 8.3.2, 8.3.3,
8.3.4, 8.3.5, 8.3.6, 8.3.7, 8.3.8, 8.3.9, 8.3.10, 8.4, 8.4.0, 8.4.1, 8.4.2,
8.4.3, 8.4.4, 8.4.5, 8.4.6, 8.4.7, 8.4.8, 8.4.9, 8.4.10, 8.4.11, 8.5, 8.5.0,
8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.6, 8.5.7, 8.5.8, 8.5.9, 8.5.10, 8.5.11,
8.5.12, 8.5.13, 8.6, 8.6.0, 8.6.1, 8.6.2, 8.6.3, 8.6.4, 8.6.5, 8.6.6, 8.6.7,
8.6.8, 8.6.9, 8.7, 8.7.0, 8.7.1, 8.7.2, 8.7.3, 8.7.4, 8.7.5, 8.7.6, 8.7.7,
8.7.8, 8.7.9, 8.8, 8.8.0, 8.8.1, 8.8.2, 8.8.3, 8.8.4, 8.8.5, 8.8.6, 8.8.7,
8.8.8, 8.8.9, 8.9, 8.9.0, 8.9.1, 8.9.2, 8.9.3, 8.9.4, 8.9.5, 8.9.6, 8.9.7,
8.9.8, 8.9.9, 8.9.10, 8.9.11, 8.10, 8.10.0, 8.10.1, 8.10.2, 8.10.3, 8.10.4,
8.10.5, 8.10.6, 8.10.7, 8.10.8, 8.10.9, 8.10.10, 8.10.11, 8.10.12, 8.10.13,
8.11, 8.11.0, 8.11.1, 8.11.2, 8.11.3, 8.11.4, 8.11.5, 8.11.6, 8.11.7, 8.11.8,
8.11.9, 8.11.10, 8.11.11, 8.12, 8.12.0, 8.12.1, 8.12.2, 8.12.3, 8.12.4, 8.12.5,
8.12.6, 8.12.7, 8.12.8, 8.12.9, 8.12.10, 8.12.11, 8.12.12, 8.12.13, 8.13,
8.13.0, 8.13.1, 8.13.2, 8.13.3, 8.13.4, 8.13.5, 8.13.6, 8.13.7, 8.13.8, 8.13.9,
8.13.10, 8.13.11, 8.13.12, 8.14, 8.14.0, 8.14.1, 8.14.2, 8.14.3, 8.14.4, 8.14.5,
8.14.6, 8.14.7, 8.14.8, 8.14.9, 8.14.10, 8.15, 8.15.0, 8.15.1, 8.15.2, 8.15.3,
8.15.4, 8.15.5, 8.15.6, 8.15.7, 8.15.8, 8.16.0, 8.16.1, 8.16.2, 8.16.3, 8.16.4,
8.16.5, 8.16.6, 8.16.7, 8.16.8, 8.16.9, 8.17, 8.17.0, 8.17.1, 8.17.2, 8.17.3,
8.17.4, 8.17.5, 8.17.6, 8.17.7, 8.17.8, 9.0, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4,
9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.1, 9.1.0,
9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.1.10, 9.2,
9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10,
9.3, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7, 9.3.8, 9.3.9,
9.3.10, 9.3.11, 9.4, 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6, 9.4.7,
9.5, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 9.5.4, 9.5.5, 9.5.6, 9.5.7, 9.5.8, 9.5.9,
9.5.10, 9.55, 10.0, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6,
10.0.7, 10.1, 10.1.0, 10.1.1, 10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7,
10.2, 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.2.8,
10.3, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.3.7, 10.3.8,
10.3.9, 10.4, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6, 10.4.7,
10.5, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5, 10.5.6, 10.5.7, 10.5.8,
10.6, 10.6.0, 10.6.1, 10.6.2, 10.6.3, 10.6.4, 10.6.5, 10.6.6, 10.7, 10.7.0,
10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6, 10.7.7, 10.8, 10.8.0, 10.8.1,
10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 10.8.7, 11.0, 11.0.0, 11.0.1, 11.0.2,
11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.1, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4,
11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.2, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4,
11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3, 11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4,
11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10, 11.3.11, 11.3.12, 11.3.13,
11.3.14, 11.4, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7,
11.4.8, 11.4.9, 11.4.10, 11.4.11, 11.4.12, 11.4.13, 11.4.14, 11.5.0, 11.5.1,
11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10,
11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.6, 11.6.7, 11.6.8,
11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.4, 11.7.5,
11.7.6, 11.7.7, 11.7.8, 11.7.9, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.1,
11.8.2, 11.8.3, 11.8.4, 11.8.5, 11.8.6, 11.8.7, 11.8.8, 11.8.9, 11.8.10, 11.9.0,
11.9.1, 11.9.2, 11.9.3, 11.9.4, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10,
11.9.11, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.5, 11.10.6,
11.10.7, 11.10.8, 11.11.0, 11.11.1, 11.11.2, 11.11.3, 11.11.4, 11.11.5, 11.11.7,
11.11.8, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.6, 12.0.8, 12.0.9,
12.0.10, 12.0.12, 12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.6, 12.1.8,
12.1.9, 12.1.10, 12.1.11, 12.1.12, 12.1.13, 12.1.14, 12.1.15, 12.1.16, 12.1.17,
12.2.0, 12.2.1, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10,
12.2.11, 12.2.12, 12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6,
12.3.7, 12.3.8, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.4.5, 12.4.6,
12.4.7, 12.4.8, 12.5.0, 12.5.1, 12.5.2, 12.5.3, 12.5.4, 12.5.5, 12.5.6, 12.5.7,
12.5.9, 12.5.10, 12.6.0, 12.6.1, 12.6.2, 12.6.3, 12.6.4, 12.6.6, 12.6.7, 12.6.8,
12.7.0, 12.7.1, 12.7.2, 12.7.4, 12.7.5, 12.7.6, 12.7.7, 12.7.8, 12.7.9, 12.8.0,
12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.8, 12.8.9, 12.8.10,
12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7, 12.9.8, 12.9.9,
12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5, 12.10.6, 12.10.7,
12.10.8, 12.10.9, 12.10.10, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0,
13.0.1, 13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10,
13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5,
13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11, 13.2.0, 13.2.1, 13.2.2,
13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1,
13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3,
13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5,
13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7,
13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7,
13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0,
14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 6.2.0, 6.3.0, 6.4.0, 6.5.0, 6.6.0, 6.6.1, 6.6.2,
6.7.0, 6.7.1, 6.8.0, 6.9.0, 6.9.1, 6.9.2, 6.9.3, 6.9.4, 7.0.0, 7.1.0, 7.2.0,
7.3.0, 7.4.0, 7.4.4, 7.5.0, 7.5.3, 7.6.0, 7.6.1, 7.6.2, 7.7.0, 7.8.0, 7.9.0,
7.10.0, 7.10.1, 7.11.0, 7.11.2, 7.11.3, 7.11.4, 7.12.0, 7.12.1, 7.12.2, 7.13.0,
7.13.1, 7.13.2, 7.13.3, 7.14.0, 7.14.1, 7.14.2, 7.14.3, 8.0.0, 8.0.1, 8.0.2,
8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.2.0, 8.2.1,
8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.3.4, 8.3.5,
8.3.6, 8.3.7, 8.3.8, 8.3.9, 8.3.10, 8.4.0, 8.4.1, 8.4.2, 8.4.3, 8.4.4, 8.4.5,
8.4.6, 8.4.7, 8.4.8, 8.4.9, 8.4.10, 8.4.11, 8.5.0, 8.5.1, 8.5.2, 8.5.3, 8.5.4,
8.5.5, 8.5.6, 8.5.7, 8.5.8, 8.5.9, 8.5.10, 8.5.11, 8.5.12, 8.5.13, 8.6.0, 8.6.1,
8.6.2, 8.6.3, 8.6.4, 8.6.5, 8.6.6, 8.6.7, 8.6.8, 8.6.9, 8.7.0, 8.7.1, 8.7.2,
8.7.3, 8.7.4, 8.7.5, 8.7.6, 8.7.7, 8.7.8, 8.7.9, 8.8.0, 8.8.1, 8.8.2, 8.8.3,
8.8.4, 8.8.5, 8.8.6, 8.8.7, 8.8.8, 8.8.9, 8.9.0, 8.9.1, 8.9.2, 8.9.3, 8.9.4,
8.9.5, 8.9.6, 8.9.7, 8.9.8, 8.9.9, 8.9.10, 8.10.0, 8.10.1, 8.10.2, 8.10.3,
8.10.4, 8.10.5, 8.10.6, 8.10.7, 8.10.8, 8.10.9, 8.10.10, 8.10.11, 8.10.12,
8.11.0, 8.11.1, 8.11.2, 8.11.3, 8.11.4, 8.11.5, 8.11.6, 8.11.7, 8.11.8, 8.11.9,
8.11.10, 8.11.11, 8.12.0, 8.12.1, 8.12.2, 8.12.3, 8.12.4, 8.12.5, 8.12.6,
8.12.7, 8.12.8, 8.12.9, 8.12.10, 8.12.11, 8.12.12, 8.13.0, 8.13.1, 8.13.2,
8.13.3, 8.13.4, 8.13.5, 8.13.6, 8.13.7, 8.13.8, 8.13.9, 8.13.10, 8.13.11,
8.13.12, 8.14.0, 8.14.1, 8.14.2, 8.14.3, 8.14.4, 8.14.5, 8.14.6, 8.14.7, 8.14.8,
8.14.9, 8.14.10, 8.15.0, 8.15.1, 8.15.2, 8.15.3, 8.15.4, 8.15.5, 8.15.6, 8.15.7,
8.15.8, 8.16.0, 8.16.1, 8.16.2, 8.16.3, 8.16.4, 8.16.5, 8.16.6, 8.16.7, 8.16.8,
8.16.9, 8.17.0, 8.17.1, 8.17.2, 8.17.3, 8.17.4, 8.17.5, 8.17.6, 8.17.7, 8.17.8,
9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10,
9.0.11, 9.0.12, 9.0.13, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7,
9.1.8, 9.1.9, 9.1.10, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7,
9.2.8, 9.2.9, 9.2.10, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7,
9.3.8, 9.3.9, 9.3.10, 9.3.11, 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6,
9.4.7, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 9.5.4, 9.5.5, 9.5.6, 9.5.7, 9.5.8, 9.5.9,
9.5.10, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.7, 10.1.0, 10.1.1,
10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.2.0, 10.2.1, 10.2.2, 10.2.3,
10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.2.8, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4,
10.3.5, 10.3.6, 10.3.7, 10.3.8, 10.3.9, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4,
10.4.5, 10.4.6, 10.4.7, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5, 10.5.6,
10.5.7, 10.5.8, 10.6.0, 10.6.1, 10.6.2, 10.6.3, 10.6.4, 10.6.5, 10.6.6, 10.7.0,
10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6, 10.7.7, 10.8.0, 10.8.1, 10.8.2,
10.8.3, 10.8.4, 10.8.5, 10.8.6, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5,
11.0.6, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.2.0,
11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3.0, 11.3.1,
11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10,
11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5,
11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.5, 11.5.8,
11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.8,
11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.5, 11.7.7,
11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.2, 11.8.3, 11.8.6, 11.8.7,
11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9,
11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.6, 11.10.7,
11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4, 11.11.7, 11.11.8, 12.0.0, 12.0.1,
12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10, 12.0.12, 12.1.1, 12.1.2, 12.1.3,
12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12, 12.1.14, 12.2.0, 12.2.1, 12.2.2,
12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.11, 12.3.0, 12.3.1, 12.3.2,
12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.5, 12.4.8, 12.5.0,
12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0, 12.6.1, 12.6.2, 12.6.4,
12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5, 12.7.9,
12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9, 12.8.10,
12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8, 12.9.10,
12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0,
13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:14.5.1:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) SERVER-SIDE REQUEST FORGERY (SSRF)
EUVDB-ID: #VU58754
Risk: Medium
CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39935
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
Exploit availability: No
Description
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input.
A remote attacker can send a specially crafted HTTP request and trick the
application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain
access to sensitive data, located in the local network or send malicious
requests to other servers from the vulnerable system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 10.5, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5,
10.5.6, 10.5.7, 10.5.8, 10.6, 10.6.0, 10.6.1, 10.6.2, 10.6.3, 10.6.4, 10.6.5,
10.6.6, 10.7, 10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6, 10.7.7,
10.8, 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 10.8.7, 11.0,
11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.1, 11.1.0, 11.1.1,
11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.2, 11.2.0, 11.2.1,
11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3, 11.3.0, 11.3.1,
11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10,
11.3.11, 11.3.12, 11.3.13, 11.3.14, 11.4, 11.4.0, 11.4.1, 11.4.2, 11.4.3,
11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.4.10, 11.4.11, 11.4.12,
11.4.13, 11.4.14, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6,
11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3,
11.6.4, 11.6.5, 11.6.6, 11.6.7, 11.6.8, 11.6.9, 11.6.10, 11.6.11, 11.7.0,
11.7.1, 11.7.2, 11.7.3, 11.7.4, 11.7.5, 11.7.6, 11.7.7, 11.7.8, 11.7.9, 11.7.10,
11.7.11, 11.7.12, 11.8.0, 11.8.1, 11.8.2, 11.8.3, 11.8.4, 11.8.5, 11.8.6,
11.8.7, 11.8.8, 11.8.9, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.4, 11.9.5,
11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10, 11.9.11, 11.9.12, 11.10.0, 11.10.1,
11.10.2, 11.10.3, 11.10.4, 11.10.5, 11.10.6, 11.10.7, 11.10.8, 11.11.0, 11.11.1,
11.11.2, 11.11.3, 11.11.4, 11.11.5, 11.11.7, 11.11.8, 12.0.0, 12.0.1, 12.0.2,
12.0.3, 12.0.4, 12.0.6, 12.0.8, 12.0.9, 12.0.10, 12.0.12, 12.1.0, 12.1.1,
12.1.2, 12.1.3, 12.1.4, 12.1.6, 12.1.8, 12.1.9, 12.1.10, 12.1.11, 12.1.12,
12.1.13, 12.1.14, 12.1.15, 12.1.16, 12.1.17, 12.2.0, 12.2.1, 12.2.3, 12.2.4,
12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.3.0,
12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6, 12.3.7, 12.3.8, 12.3.9, 12.4.0,
12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.4.5, 12.4.6, 12.4.7, 12.4.8, 12.5.0, 12.5.1,
12.5.2, 12.5.3, 12.5.4, 12.5.5, 12.5.6, 12.5.7, 12.5.9, 12.5.10, 12.6.0, 12.6.1,
12.6.2, 12.6.3, 12.6.4, 12.6.6, 12.6.7, 12.6.8, 12.7.0, 12.7.1, 12.7.2, 12.7.4,
12.7.5, 12.7.6, 12.7.7, 12.7.8, 12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4,
12.8.5, 12.8.6, 12.8.7, 12.8.8, 12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3,
12.9.4, 12.9.5, 12.9.6, 12.9.7, 12.9.8, 12.9.9, 12.9.10, 12.10.0, 12.10.1,
12.10.2, 12.10.3, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8, 12.10.9,
12.10.10, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.2,
13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.12,
13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5, 13.1.6,
13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11, 13.2.0, 13.2.1, 13.2.2, 13.2.3,
13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1, 13.3.2,
13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0,
14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5,
10.5.6, 10.5.7, 10.5.8, 10.6.0, 10.6.1, 10.6.2, 10.6.3, 10.6.4, 10.6.5, 10.6.6,
10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6, 10.7.7, 10.8.0, 10.8.1,
10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4,
11.0.5, 11.0.6, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7,
11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3.0,
11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10,
11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5,
11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.5, 11.5.8,
11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.8,
11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.5, 11.7.7,
11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.2, 11.8.3, 11.8.6, 11.8.7,
11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9,
11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.6, 11.10.7,
11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4, 11.11.7, 11.11.8, 12.0.0, 12.0.1,
12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10, 12.0.12, 12.1.1, 12.1.2, 12.1.3,
12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12, 12.1.14, 12.2.0, 12.2.1, 12.2.2,
12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.11, 12.3.0, 12.3.1, 12.3.2,
12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.5, 12.4.8, 12.5.0,
12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0, 12.6.1, 12.6.2, 12.6.4,
12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5, 12.7.9,
12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9, 12.8.10,
12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8, 12.9.10,
12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0,
13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:10.5.8:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker
via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) INPUT VALIDATION ERROR
EUVDB-ID: #VU58769
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39933
CWE-ID: CWE-20 - Improper Input Validation
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS)
attack.
The vulnerability exists due to insufficient validation of user-supplied input
within user comments. A remote authenticated attacker can pass specially crafted
input to the application and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5,
12.10.6, 12.10.7, 12.10.8, 12.10.9, 12.10.10, 12.10.11, 12.10.12, 12.10.13,
12.10.14, 13.0.0, 13.0.1, 13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7,
13.0.8, 13.0.9, 13.0.10, 13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2,
13.1.3, 13.1.4, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11,
13.2.0, 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9,
13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8,
13.3.9, 13.4.0, 13.4.1, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0,
13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2,
13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4,
13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4,
13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5,
13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0,
13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1,
13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6,
14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5,
14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1,
14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6,
12.10.7, 12.10.8, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1,
13.0.3, 13.0.4, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12,
13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7,
13.1.8, 13.1.9, 13.1.10, 13.2.0, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7,
13.2.8, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7,
13.3.8, 13.3.9, 13.4.0, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0,
13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2,
13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4,
13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4,
13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5,
13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0,
13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1,
13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 13.12.12, 13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10,
14.0.11, 14.0.12, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6,
14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7,
14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3,
14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:12.10.14:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) IMPROPER ACCESS CONTROL
EUVDB-ID: #VU58778
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39934
CWE-ID: CWE-284 - Improper Access Control
Exploit availability: No
Description
The vulnerability allows a remote attacker to gain unauthorized access to
otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote
authenticated attacker can bypass implemented security restrictions and retrieve
the service desk email address.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5,
12.10.6, 12.10.7, 12.10.8, 12.10.9, 12.10.10, 12.10.11, 12.10.12, 12.10.13,
12.10.14, 13.0.0, 13.0.1, 13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7,
13.0.8, 13.0.9, 13.0.10, 13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2,
13.1.3, 13.1.4, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11,
13.2.0, 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9,
13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8,
13.3.9, 13.4.0, 13.4.1, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0,
13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2,
13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4,
13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4,
13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5,
13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0,
13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1,
13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6,
14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5,
14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1,
14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6,
12.10.7, 12.10.8, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1,
13.0.3, 13.0.4, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12,
13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7,
13.1.8, 13.1.9, 13.1.10, 13.2.0, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7,
13.2.8, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7,
13.3.8, 13.3.9, 13.4.0, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0,
13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2,
13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4,
13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4,
13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5,
13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0,
13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1,
13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 13.12.12, 13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10,
14.0.11, 14.0.12, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6,
14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7,
14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3,
14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:12.10.14:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) INPUT VALIDATION ERROR
EUVDB-ID: #VU58779
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39917
CWE-ID: CWE-20 - Improper Input Validation
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS)
attack.
The vulnerability exists due to insufficient validation of user-supplied input
within quick actions. A remote authenticated attacker can pass specially crafted
input to the application and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5,
12.9.6, 12.9.7, 12.9.8, 12.9.9, 12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.3,
12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8, 12.10.9, 12.10.10, 12.10.11,
12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.2, 13.0.3, 13.0.4, 13.0.5,
13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10,
13.1.11, 13.2.0, 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8,
13.2.9, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7,
13.3.8, 13.3.9, 13.4.0, 13.4.1, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7,
13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1,
13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3,
13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3,
13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4,
13.9.5, 13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5,
13.11.0, 13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0,
13.12.1, 13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6,
14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5,
14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1,
14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5,
12.9.6, 12.9.8, 12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6,
12.10.7, 12.10.8, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1,
13.0.3, 13.0.4, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12,
13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7,
13.1.8, 13.1.9, 13.1.10, 13.2.0, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7,
13.2.8, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7,
13.3.8, 13.3.9, 13.4.0, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0,
13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2,
13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4,
13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4,
13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5,
13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0,
13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1,
13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 13.12.12, 13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10,
14.0.11, 14.0.12, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6,
14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7,
14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3,
14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:12.9.10:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) IMPROPER ACCESS CONTROL
EUVDB-ID: #VU58780
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39916
CWE-ID: CWE-284 - Improper Access Control
Exploit availability: No
Description
The vulnerability allows a remote attacker to gain unauthorized access to
otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the External
Status Check feature. A remote authenticated attacker can bypass implemented
security restrictions and retrieve the configuration of any External Status
Check.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
GitLab Enterprise Edition: 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5,
14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.4, 14.2.5, 14.2.6,
14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2,
14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab-ee:14.4.3:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) INFORMATION DISCLOSURE
EUVDB-ID: #VU58781
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39941
CWE-ID: CWE-200 - Information Exposure
Exploit availability: No
Description
The vulnerability allows a remote attacker to gain access to potentially
sensitive information.
The vulnerability exists due to excessive data output by the application. A
remote attacker can see the default branch name for projects that restrict
access to the repository to project members.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.6,
12.0.8, 12.0.9, 12.0.10, 12.0.12, 12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.4,
12.1.6, 12.1.8, 12.1.9, 12.1.10, 12.1.11, 12.1.12, 12.1.13, 12.1.14, 12.1.15,
12.1.16, 12.1.17, 12.2.0, 12.2.1, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7,
12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.3.0, 12.3.1, 12.3.2, 12.3.3,
12.3.4, 12.3.5, 12.3.6, 12.3.7, 12.3.8, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3,
12.4.4, 12.4.5, 12.4.6, 12.4.7, 12.4.8, 12.5.0, 12.5.1, 12.5.2, 12.5.3, 12.5.4,
12.5.5, 12.5.6, 12.5.7, 12.5.9, 12.5.10, 12.6.0, 12.6.1, 12.6.2, 12.6.3, 12.6.4,
12.6.6, 12.6.7, 12.6.8, 12.7.0, 12.7.1, 12.7.2, 12.7.4, 12.7.5, 12.7.6, 12.7.7,
12.7.8, 12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7,
12.8.8, 12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6,
12.9.7, 12.9.8, 12.9.9, 12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4,
12.10.5, 12.10.6, 12.10.7, 12.10.8, 12.10.9, 12.10.10, 12.10.11, 12.10.12,
12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1,
13.1.2, 13.1.3, 13.1.4, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10,
13.1.11, 13.2.0, 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8,
13.2.9, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7,
13.3.8, 13.3.9, 13.4.0, 13.4.1, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7,
13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1,
13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3,
13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3,
13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4,
13.9.5, 13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5,
13.11.0, 13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0,
13.12.1, 13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6,
14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5,
14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1,
14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 12.0.0, 12.0.1, 12.0.2, 12.0.6, 12.0.7, 12.0.9,
12.0.10, 12.0.12, 12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.5, 12.1.9, 12.1.10,
12.1.12, 12.1.14, 12.2.0, 12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6,
12.2.7, 12.2.8, 12.2.11, 12.3.0, 12.3.1, 12.3.2, 12.3.4, 12.3.7, 12.3.9, 12.4.0,
12.4.1, 12.4.2, 12.4.3, 12.4.5, 12.4.8, 12.5.0, 12.5.1, 12.5.3, 12.5.4, 12.5.5,
12.5.8, 12.5.9, 12.6.0, 12.6.1, 12.6.2, 12.6.4, 12.6.5, 12.6.6, 12.6.7, 12.7.0,
12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5, 12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3,
12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3,
12.9.4, 12.9.5, 12.9.6, 12.9.8, 12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.4,
12.10.5, 12.10.6, 12.10.7, 12.10.8, 12.10.11, 12.10.12, 12.10.13, 12.10.14,
13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10,
13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.5,
13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0, 13.2.2, 13.2.3, 13.2.4, 13.2.5,
13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5,
13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6,
13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0,
13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2,
13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2,
13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3,
13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4,
13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7,
13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8,
13.12.9, 13.12.10, 13.12.11, 13.12.12, 13.12.13, 13.12.14, 13.12.15, 14.0.0,
14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10,
14.0.11, 14.0.12, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6,
14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7,
14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3,
14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:12.10.14:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker
via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) IMPROPER ACCESS CONTROL
EUVDB-ID: #VU58782
Risk: Low
CVSSv3.1: 3.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39936
CWE-ID: CWE-284 - Improper Access Control
Exploit availability: No
Description
The vulnerability allows a remote attacker to gain unauthorized access to
otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote
authenticated attacker can bypass implemented security restrictions and access a
project's disabled wiki.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 10.7, 10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5,
10.7.6, 10.7.7, 10.8, 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6,
10.8.7, 11.0, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.1,
11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.2,
11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3,
11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9,
11.3.10, 11.3.11, 11.3.12, 11.3.13, 11.3.14, 11.4, 11.4.0, 11.4.1, 11.4.2,
11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.4.10, 11.4.11,
11.4.12, 11.4.13, 11.4.14, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5,
11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2,
11.6.3, 11.6.4, 11.6.5, 11.6.6, 11.6.7, 11.6.8, 11.6.9, 11.6.10, 11.6.11,
11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.4, 11.7.5, 11.7.6, 11.7.7, 11.7.8, 11.7.9,
11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.1, 11.8.2, 11.8.3, 11.8.4, 11.8.5,
11.8.6, 11.8.7, 11.8.8, 11.8.9, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.4,
11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10, 11.9.11, 11.9.12, 11.10.0,
11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.5, 11.10.6, 11.10.7, 11.10.8, 11.11.0,
11.11.1, 11.11.2, 11.11.3, 11.11.4, 11.11.5, 11.11.7, 11.11.8, 12.0.0, 12.0.1,
12.0.2, 12.0.3, 12.0.4, 12.0.6, 12.0.8, 12.0.9, 12.0.10, 12.0.12, 12.1.0,
12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.6, 12.1.8, 12.1.9, 12.1.10, 12.1.11,
12.1.12, 12.1.13, 12.1.14, 12.1.15, 12.1.16, 12.1.17, 12.2.0, 12.2.1, 12.2.3,
12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12,
12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6, 12.3.7, 12.3.8, 12.3.9,
12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.4.5, 12.4.6, 12.4.7, 12.4.8, 12.5.0,
12.5.1, 12.5.2, 12.5.3, 12.5.4, 12.5.5, 12.5.6, 12.5.7, 12.5.9, 12.5.10, 12.6.0,
12.6.1, 12.6.2, 12.6.3, 12.6.4, 12.6.6, 12.6.7, 12.6.8, 12.7.0, 12.7.1, 12.7.2,
12.7.4, 12.7.5, 12.7.6, 12.7.7, 12.7.8, 12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3,
12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.8, 12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2,
12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7, 12.9.8, 12.9.9, 12.9.10, 12.10.0,
12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8, 12.10.9,
12.10.10, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.2,
13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.12,
13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5, 13.1.6,
13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11, 13.2.0, 13.2.1, 13.2.2, 13.2.3,
13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1, 13.3.2,
13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0,
14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5,
10.7.6, 10.7.7, 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 11.0.0,
11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.1.0, 11.1.1, 11.1.2, 11.1.3,
11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5,
11.2.6, 11.2.7, 11.2.8, 11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6,
11.3.7, 11.3.8, 11.3.9, 11.3.10, 11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1,
11.4.2, 11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1,
11.5.2, 11.5.3, 11.5.5, 11.5.8, 11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2,
11.6.3, 11.6.4, 11.6.5, 11.6.8, 11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1,
11.7.2, 11.7.3, 11.7.5, 11.7.7, 11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0,
11.8.2, 11.8.3, 11.8.6, 11.8.7, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5,
11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2,
11.10.3, 11.10.4, 11.10.6, 11.10.7, 11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4,
11.11.7, 11.11.8, 12.0.0, 12.0.1, 12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10,
12.0.12, 12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12,
12.1.14, 12.2.0, 12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8,
12.2.11, 12.3.0, 12.3.1, 12.3.2, 12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2,
12.4.3, 12.4.5, 12.4.8, 12.5.0, 12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9,
12.6.0, 12.6.1, 12.6.2, 12.6.4, 12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2,
12.7.3, 12.7.4, 12.7.5, 12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5,
12.8.6, 12.8.7, 12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5,
12.9.6, 12.9.8, 12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6,
12.10.7, 12.10.8, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1,
13.0.3, 13.0.4, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12,
13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7,
13.1.8, 13.1.9, 13.1.10, 13.2.0, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7,
13.2.8, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7,
13.3.8, 13.3.9, 13.4.0, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0,
13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2,
13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4,
13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4,
13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5,
13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0,
13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1,
13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 13.12.12, 13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10,
14.0.11, 14.0.12, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6,
14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7,
14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3,
14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:10.7.0:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
15) RESOURCE EXHAUSTION
EUVDB-ID: #VU58783
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39938
CWE-ID: CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS)
attack.
The vulnerability exists due to application does not properly control
consumption of internal resources within deploy Slash commands. A remote
authenticated attacker can trigger resource exhaustion and perform a denial of
service (DoS) attack.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 8.15, 8.15.0, 8.15.1, 8.15.2, 8.15.3, 8.15.4, 8.15.5,
8.15.6, 8.15.7, 8.15.8, 8.16.0, 8.16.1, 8.16.2, 8.16.3, 8.16.4, 8.16.5, 8.16.6,
8.16.7, 8.16.8, 8.16.9, 8.17, 8.17.0, 8.17.1, 8.17.2, 8.17.3, 8.17.4, 8.17.5,
8.17.6, 8.17.7, 8.17.8, 9.0, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6,
9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.1, 9.1.0, 9.1.1, 9.1.2,
9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.1.10, 9.2, 9.2.0, 9.2.1,
9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10, 9.3, 9.3.0,
9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7, 9.3.8, 9.3.9, 9.3.10, 9.3.11,
9.4, 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6, 9.4.7, 9.5, 9.5.0, 9.5.1,
9.5.2, 9.5.3, 9.5.4, 9.5.5, 9.5.6, 9.5.7, 9.5.8, 9.5.9, 9.5.10, 9.55, 10.0,
10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.1, 10.1.0,
10.1.1, 10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.2, 10.2.0, 10.2.1,
10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.2.8, 10.3, 10.3.0, 10.3.1,
10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.3.7, 10.3.8, 10.3.9, 10.4, 10.4.0,
10.4.1, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6, 10.4.7, 10.5, 10.5.0, 10.5.1,
10.5.2, 10.5.3, 10.5.4, 10.5.5, 10.5.6, 10.5.7, 10.5.8, 10.6, 10.6.0, 10.6.1,
10.6.2, 10.6.3, 10.6.4, 10.6.5, 10.6.6, 10.7, 10.7.0, 10.7.1, 10.7.2, 10.7.3,
10.7.4, 10.7.5, 10.7.6, 10.7.7, 10.8, 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4,
10.8.5, 10.8.6, 10.8.7, 11.0, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5,
11.0.6, 11.1, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7,
11.1.8, 11.2, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7,
11.2.8, 11.3, 11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7,
11.3.8, 11.3.9, 11.3.10, 11.3.11, 11.3.12, 11.3.13, 11.3.14, 11.4, 11.4.0,
11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.4.10,
11.4.11, 11.4.12, 11.4.13, 11.4.14, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4,
11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.5.11, 11.6.0, 11.6.1,
11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.6, 11.6.7, 11.6.8, 11.6.9, 11.6.10,
11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.4, 11.7.5, 11.7.6, 11.7.7, 11.7.8,
11.7.9, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.1, 11.8.2, 11.8.3, 11.8.4,
11.8.5, 11.8.6, 11.8.7, 11.8.8, 11.8.9, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3,
11.9.4, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10, 11.9.11, 11.9.12,
11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.5, 11.10.6, 11.10.7, 11.10.8,
11.11.0, 11.11.1, 11.11.2, 11.11.3, 11.11.4, 11.11.5, 11.11.7, 11.11.8, 12.0.0,
12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.6, 12.0.8, 12.0.9, 12.0.10, 12.0.12,
12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.6, 12.1.8, 12.1.9, 12.1.10,
12.1.11, 12.1.12, 12.1.13, 12.1.14, 12.1.15, 12.1.16, 12.1.17, 12.2.0, 12.2.1,
12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11,
12.2.12, 12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6, 12.3.7, 12.3.8,
12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.4.5, 12.4.6, 12.4.7, 12.4.8,
12.5.0, 12.5.1, 12.5.2, 12.5.3, 12.5.4, 12.5.5, 12.5.6, 12.5.7, 12.5.9, 12.5.10,
12.6.0, 12.6.1, 12.6.2, 12.6.3, 12.6.4, 12.6.6, 12.6.7, 12.6.8, 12.7.0, 12.7.1,
12.7.2, 12.7.4, 12.7.5, 12.7.6, 12.7.7, 12.7.8, 12.7.9, 12.8.0, 12.8.1, 12.8.2,
12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.8, 12.8.9, 12.8.10, 12.9.0, 12.9.1,
12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7, 12.9.8, 12.9.9, 12.9.10,
12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.9, 12.10.10, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1,
13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10,
13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5,
13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11, 13.2.0, 13.2.1, 13.2.2,
13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1,
13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3,
13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5,
13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7,
13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7,
13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0,
14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 8.15.0, 8.15.1, 8.15.2, 8.15.3, 8.15.4, 8.15.5,
8.15.6, 8.15.7, 8.15.8, 8.16.0, 8.16.1, 8.16.2, 8.16.3, 8.16.4, 8.16.5, 8.16.6,
8.16.7, 8.16.8, 8.16.9, 8.17.0, 8.17.1, 8.17.2, 8.17.3, 8.17.4, 8.17.5, 8.17.6,
8.17.7, 8.17.8, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8,
9.0.9, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5,
9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.1.10, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5,
9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5,
9.3.6, 9.3.7, 9.3.8, 9.3.9, 9.3.10, 9.3.11, 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4,
9.4.5, 9.4.6, 9.4.7, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 9.5.4, 9.5.5, 9.5.6, 9.5.7,
9.5.8, 9.5.9, 9.5.10, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.7,
10.1.0, 10.1.1, 10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.2.0, 10.2.1,
10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.2.8, 10.3.0, 10.3.1, 10.3.2,
10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.3.7, 10.3.8, 10.3.9, 10.4.0, 10.4.1, 10.4.2,
10.4.3, 10.4.4, 10.4.5, 10.4.6, 10.4.7, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4,
10.5.5, 10.5.6, 10.5.7, 10.5.8, 10.6.0, 10.6.1, 10.6.2, 10.6.3, 10.6.4, 10.6.5,
10.6.6, 10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6, 10.7.7, 10.8.0,
10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 11.0.0, 11.0.1, 11.0.2, 11.0.3,
11.0.4, 11.0.5, 11.0.6, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6,
11.1.7, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8,
11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9,
11.3.10, 11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4,
11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.5,
11.5.8, 11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5,
11.6.8, 11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.5,
11.7.7, 11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.2, 11.8.3, 11.8.6,
11.8.7, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5, 11.9.6, 11.9.7, 11.9.8,
11.9.9, 11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.6,
11.10.7, 11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4, 11.11.7, 11.11.8, 12.0.0,
12.0.1, 12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10, 12.0.12, 12.1.1, 12.1.2,
12.1.3, 12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12, 12.1.14, 12.2.0, 12.2.1,
12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.11, 12.3.0, 12.3.1,
12.3.2, 12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.5, 12.4.8,
12.5.0, 12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0, 12.6.1, 12.6.2,
12.6.4, 12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5,
12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9,
12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8,
12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0,
13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:8.15.0:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
16) IMPROPER AUTHORIZATION
EUVDB-ID: #VU58784
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39918
CWE-ID: CWE-285 - Improper Authorization
Exploit availability: No
Description
The vulnerability allows a remote attacker to bypass authorization check.
The vulnerability exists due to incorrect authorization. A remote authenticated
attacker can add comments to a vulnerability which cannot be accessed.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
GitLab Enterprise Edition: 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5,
11.1.6, 11.1.7, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7,
11.2.8, 11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8,
11.3.9, 11.3.10, 11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1, 11.4.2, 11.4.3,
11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1, 11.5.2, 11.5.3,
11.5.5, 11.5.8, 11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4,
11.6.5, 11.6.8, 11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3,
11.7.5, 11.7.7, 11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.2, 11.8.3,
11.8.6, 11.8.7, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5, 11.9.6, 11.9.7,
11.9.8, 11.9.9, 11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4,
11.10.6, 11.10.7, 11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4, 11.11.7, 11.11.8,
12.0.0, 12.0.1, 12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10, 12.0.12, 12.1.1,
12.1.2, 12.1.3, 12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12, 12.1.14, 12.2.0,
12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.11, 12.3.0,
12.3.1, 12.3.2, 12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.5,
12.4.8, 12.5.0, 12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0, 12.6.1,
12.6.2, 12.6.4, 12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4,
12.7.5, 12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7,
12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8,
12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0,
13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab-ee:11.11.8:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
17) BUSINESS LOGIC ERRORS
EUVDB-ID: #VU58785
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39931
CWE-ID: CWE-840 - Business Logic Errors (3.0)
Exploit availability: No
Description
The vulnerability allows a remote attacker to gain unauthorized access to
otherwise restricted functionality.
The vulnerability exists due to a business logic error. A remote authenticated
attacker can bypass implemented security restrictions and delete a protected
branches
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 8.11, 8.11.0, 8.11.1, 8.11.2, 8.11.3, 8.11.4, 8.11.5,
8.11.6, 8.11.7, 8.11.8, 8.11.9, 8.11.10, 8.11.11, 8.12, 8.12.0, 8.12.1, 8.12.2,
8.12.3, 8.12.4, 8.12.5, 8.12.6, 8.12.7, 8.12.8, 8.12.9, 8.12.10, 8.12.11,
8.12.12, 8.12.13, 8.13, 8.13.0, 8.13.1, 8.13.2, 8.13.3, 8.13.4, 8.13.5, 8.13.6,
8.13.7, 8.13.8, 8.13.9, 8.13.10, 8.13.11, 8.13.12, 8.14, 8.14.0, 8.14.1, 8.14.2,
8.14.3, 8.14.4, 8.14.5, 8.14.6, 8.14.7, 8.14.8, 8.14.9, 8.14.10, 8.15, 8.15.0,
8.15.1, 8.15.2, 8.15.3, 8.15.4, 8.15.5, 8.15.6, 8.15.7, 8.15.8, 8.16.0, 8.16.1,
8.16.2, 8.16.3, 8.16.4, 8.16.5, 8.16.6, 8.16.7, 8.16.8, 8.16.9, 8.17, 8.17.0,
8.17.1, 8.17.2, 8.17.3, 8.17.4, 8.17.5, 8.17.6, 8.17.7, 8.17.8, 9.0, 9.0.0,
9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11,
9.0.12, 9.0.13, 9.1, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7,
9.1.8, 9.1.9, 9.1.10, 9.2, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6,
9.2.7, 9.2.8, 9.2.9, 9.2.10, 9.3, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5,
9.3.6, 9.3.7, 9.3.8, 9.3.9, 9.3.10, 9.3.11, 9.4, 9.4.0, 9.4.1, 9.4.2, 9.4.3,
9.4.4, 9.4.5, 9.4.6, 9.4.7, 9.5, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 9.5.4, 9.5.5,
9.5.6, 9.5.7, 9.5.8, 9.5.9, 9.5.10, 9.55, 10.0, 10.0.0, 10.0.1, 10.0.2, 10.0.3,
10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.1, 10.1.0, 10.1.1, 10.1.2, 10.1.3, 10.1.4,
10.1.5, 10.1.6, 10.1.7, 10.2, 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5,
10.2.6, 10.2.7, 10.2.8, 10.3, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5,
10.3.6, 10.3.7, 10.3.8, 10.3.9, 10.4, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4,
10.4.5, 10.4.6, 10.4.7, 10.5, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5,
10.5.6, 10.5.7, 10.5.8, 10.6, 10.6.0, 10.6.1, 10.6.2, 10.6.3, 10.6.4, 10.6.5,
10.6.6, 10.7, 10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6, 10.7.7,
10.8, 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 10.8.7, 11.0,
11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.1, 11.1.0, 11.1.1,
11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.2, 11.2.0, 11.2.1,
11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3, 11.3.0, 11.3.1,
11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10,
11.3.11, 11.3.12, 11.3.13, 11.3.14, 11.4, 11.4.0, 11.4.1, 11.4.2, 11.4.3,
11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.4.10, 11.4.11, 11.4.12,
11.4.13, 11.4.14, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6,
11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3,
11.6.4, 11.6.5, 11.6.6, 11.6.7, 11.6.8, 11.6.9, 11.6.10, 11.6.11, 11.7.0,
11.7.1, 11.7.2, 11.7.3, 11.7.4, 11.7.5, 11.7.6, 11.7.7, 11.7.8, 11.7.9, 11.7.10,
11.7.11, 11.7.12, 11.8.0, 11.8.1, 11.8.2, 11.8.3, 11.8.4, 11.8.5, 11.8.6,
11.8.7, 11.8.8, 11.8.9, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.4, 11.9.5,
11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10, 11.9.11, 11.9.12, 11.10.0, 11.10.1,
11.10.2, 11.10.3, 11.10.4, 11.10.5, 11.10.6, 11.10.7, 11.10.8, 11.11.0, 11.11.1,
11.11.2, 11.11.3, 11.11.4, 11.11.5, 11.11.7, 11.11.8, 12.0.0, 12.0.1, 12.0.2,
12.0.3, 12.0.4, 12.0.6, 12.0.8, 12.0.9, 12.0.10, 12.0.12, 12.1.0, 12.1.1,
12.1.2, 12.1.3, 12.1.4, 12.1.6, 12.1.8, 12.1.9, 12.1.10, 12.1.11, 12.1.12,
12.1.13, 12.1.14, 12.1.15, 12.1.16, 12.1.17, 12.2.0, 12.2.1, 12.2.3, 12.2.4,
12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.3.0,
12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6, 12.3.7, 12.3.8, 12.3.9, 12.4.0,
12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.4.5, 12.4.6, 12.4.7, 12.4.8, 12.5.0, 12.5.1,
12.5.2, 12.5.3, 12.5.4, 12.5.5, 12.5.6, 12.5.7, 12.5.9, 12.5.10, 12.6.0, 12.6.1,
12.6.2, 12.6.3, 12.6.4, 12.6.6, 12.6.7, 12.6.8, 12.7.0, 12.7.1, 12.7.2, 12.7.4,
12.7.5, 12.7.6, 12.7.7, 12.7.8, 12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4,
12.8.5, 12.8.6, 12.8.7, 12.8.8, 12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3,
12.9.4, 12.9.5, 12.9.6, 12.9.7, 12.9.8, 12.9.9, 12.9.10, 12.10.0, 12.10.1,
12.10.2, 12.10.3, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8, 12.10.9,
12.10.10, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.2,
13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.12,
13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5, 13.1.6,
13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11, 13.2.0, 13.2.1, 13.2.2, 13.2.3,
13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1, 13.3.2,
13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0,
14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 8.11.0, 8.11.1, 8.11.2, 8.11.3, 8.11.4, 8.11.5,
8.11.6, 8.11.7, 8.11.8, 8.11.9, 8.11.10, 8.11.11, 8.12.0, 8.12.1, 8.12.2,
8.12.3, 8.12.4, 8.12.5, 8.12.6, 8.12.7, 8.12.8, 8.12.9, 8.12.10, 8.12.11,
8.12.12, 8.13.0, 8.13.1, 8.13.2, 8.13.3, 8.13.4, 8.13.5, 8.13.6, 8.13.7, 8.13.8,
8.13.9, 8.13.10, 8.13.11, 8.13.12, 8.14.0, 8.14.1, 8.14.2, 8.14.3, 8.14.4,
8.14.5, 8.14.6, 8.14.7, 8.14.8, 8.14.9, 8.14.10, 8.15.0, 8.15.1, 8.15.2, 8.15.3,
8.15.4, 8.15.5, 8.15.6, 8.15.7, 8.15.8, 8.16.0, 8.16.1, 8.16.2, 8.16.3, 8.16.4,
8.16.5, 8.16.6, 8.16.7, 8.16.8, 8.16.9, 8.17.0, 8.17.1, 8.17.2, 8.17.3, 8.17.4,
8.17.5, 8.17.6, 8.17.7, 8.17.8, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6,
9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.1.0, 9.1.1, 9.1.2, 9.1.3,
9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.1.10, 9.2.0, 9.2.1, 9.2.2, 9.2.3,
9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10, 9.3.0, 9.3.1, 9.3.2, 9.3.3,
9.3.4, 9.3.5, 9.3.6, 9.3.7, 9.3.8, 9.3.9, 9.3.10, 9.3.11, 9.4.0, 9.4.1, 9.4.2,
9.4.3, 9.4.4, 9.4.5, 9.4.6, 9.4.7, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 9.5.4, 9.5.5,
9.5.6, 9.5.7, 9.5.8, 9.5.9, 9.5.10, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4,
10.0.5, 10.0.7, 10.1.0, 10.1.1, 10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7,
10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.2.8, 10.3.0,
10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.3.7, 10.3.8, 10.3.9, 10.4.0,
10.4.1, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6, 10.4.7, 10.5.0, 10.5.1, 10.5.2,
10.5.3, 10.5.4, 10.5.5, 10.5.6, 10.5.7, 10.5.8, 10.6.0, 10.6.1, 10.6.2, 10.6.3,
10.6.4, 10.6.5, 10.6.6, 10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6,
10.7.7, 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 11.0.0, 11.0.1,
11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4,
11.1.5, 11.1.6, 11.1.7, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6,
11.2.7, 11.2.8, 11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7,
11.3.8, 11.3.9, 11.3.10, 11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1, 11.4.2,
11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1, 11.5.2,
11.5.3, 11.5.5, 11.5.8, 11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3,
11.6.4, 11.6.5, 11.6.8, 11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2,
11.7.3, 11.7.5, 11.7.7, 11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.2,
11.8.3, 11.8.6, 11.8.7, 11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5, 11.9.6,
11.9.7, 11.9.8, 11.9.9, 11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3,
11.10.4, 11.10.6, 11.10.7, 11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4, 11.11.7,
11.11.8, 12.0.0, 12.0.1, 12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10, 12.0.12,
12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12, 12.1.14,
12.2.0, 12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.11,
12.3.0, 12.3.1, 12.3.2, 12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3,
12.4.5, 12.4.8, 12.5.0, 12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0,
12.6.1, 12.6.2, 12.6.4, 12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3,
12.7.4, 12.7.5, 12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6,
12.8.7, 12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6,
12.9.8, 12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7,
12.10.8, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4,
13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14,
13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10,
13.2.0, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0,
13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0,
13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3,
13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5,
13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7,
13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7,
13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:8.11.0:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
18) IMPROPER ACCESS CONTROL
EUVDB-ID: #VU58786
Risk: Low
CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39945
CWE-ID: CWE-284 - Improper Access Control
Exploit availability: No
Description
The vulnerability allows a remote user to gain unauthorized access to otherwise
restricted functionality.
The vulnerability exists due to improper access restrictions. A remote
administrator can approve the Merge Request even after having their project
access revoked.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 9.4, 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6,
9.4.7, 9.5, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 9.5.4, 9.5.5, 9.5.6, 9.5.7, 9.5.8,
9.5.9, 9.5.10, 9.55, 10.0, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5,
10.0.6, 10.0.7, 10.1, 10.1.0, 10.1.1, 10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6,
10.1.7, 10.2, 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7,
10.2.8, 10.3, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.3.7,
10.3.8, 10.3.9, 10.4, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6,
10.4.7, 10.5, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5, 10.5.6, 10.5.7,
10.5.8, 10.6, 10.6.0, 10.6.1, 10.6.2, 10.6.3, 10.6.4, 10.6.5, 10.6.6, 10.7,
10.7.0, 10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6, 10.7.7, 10.8, 10.8.0,
10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 10.8.7, 11.0, 11.0.0, 11.0.1,
11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.1, 11.1.0, 11.1.1, 11.1.2, 11.1.3,
11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.2, 11.2.0, 11.2.1, 11.2.2, 11.2.3,
11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3, 11.3.0, 11.3.1, 11.3.2, 11.3.3,
11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10, 11.3.11, 11.3.12,
11.3.13, 11.3.14, 11.4, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5, 11.4.6,
11.4.7, 11.4.8, 11.4.9, 11.4.10, 11.4.11, 11.4.12, 11.4.13, 11.4.14, 11.5.0,
11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10,
11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.6, 11.6.7, 11.6.8,
11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.4, 11.7.5,
11.7.6, 11.7.7, 11.7.8, 11.7.9, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.1,
11.8.2, 11.8.3, 11.8.4, 11.8.5, 11.8.6, 11.8.7, 11.8.8, 11.8.9, 11.8.10, 11.9.0,
11.9.1, 11.9.2, 11.9.3, 11.9.4, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9, 11.9.10,
11.9.11, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.5, 11.10.6,
11.10.7, 11.10.8, 11.11.0, 11.11.1, 11.11.2, 11.11.3, 11.11.4, 11.11.5, 11.11.7,
11.11.8, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.6, 12.0.8, 12.0.9,
12.0.10, 12.0.12, 12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.1.6, 12.1.8,
12.1.9, 12.1.10, 12.1.11, 12.1.12, 12.1.13, 12.1.14, 12.1.15, 12.1.16, 12.1.17,
12.2.0, 12.2.1, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10,
12.2.11, 12.2.12, 12.3.0, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6,
12.3.7, 12.3.8, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.4, 12.4.5, 12.4.6,
12.4.7, 12.4.8, 12.5.0, 12.5.1, 12.5.2, 12.5.3, 12.5.4, 12.5.5, 12.5.6, 12.5.7,
12.5.9, 12.5.10, 12.6.0, 12.6.1, 12.6.2, 12.6.3, 12.6.4, 12.6.6, 12.6.7, 12.6.8,
12.7.0, 12.7.1, 12.7.2, 12.7.4, 12.7.5, 12.7.6, 12.7.7, 12.7.8, 12.7.9, 12.8.0,
12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.8, 12.8.9, 12.8.10,
12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7, 12.9.8, 12.9.9,
12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5, 12.10.6, 12.10.7,
12.10.8, 12.10.9, 12.10.10, 12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0,
13.0.1, 13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10,
13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.1.4, 13.1.5,
13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11, 13.2.0, 13.2.1, 13.2.2,
13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.1,
13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3,
13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5,
13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7,
13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7,
13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 14.0.0, 14.0.1,
14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0,
14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6,
9.4.7, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 9.5.4, 9.5.5, 9.5.6, 9.5.7, 9.5.8, 9.5.9,
9.5.10, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.7, 10.1.0, 10.1.1,
10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.2.0, 10.2.1, 10.2.2, 10.2.3,
10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.2.8, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4,
10.3.5, 10.3.6, 10.3.7, 10.3.8, 10.3.9, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4,
10.4.5, 10.4.6, 10.4.7, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5, 10.5.6,
10.5.7, 10.5.8, 10.6.0, 10.6.1, 10.6.2, 10.6.3, 10.6.4, 10.6.5, 10.6.6, 10.7.0,
10.7.1, 10.7.2, 10.7.3, 10.7.4, 10.7.5, 10.7.6, 10.7.7, 10.8.0, 10.8.1, 10.8.2,
10.8.3, 10.8.4, 10.8.5, 10.8.6, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5,
11.0.6, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.2.0,
11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.3.0, 11.3.1,
11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.3.10,
11.3.11, 11.3.13, 11.3.14, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5,
11.4.6, 11.4.7, 11.4.8, 11.4.9, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.5, 11.5.8,
11.5.10, 11.5.11, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 11.6.8,
11.6.9, 11.6.10, 11.6.11, 11.7.0, 11.7.1, 11.7.2, 11.7.3, 11.7.5, 11.7.7,
11.7.8, 11.7.10, 11.7.11, 11.7.12, 11.8.0, 11.8.2, 11.8.3, 11.8.6, 11.8.7,
11.8.10, 11.9.0, 11.9.1, 11.9.2, 11.9.3, 11.9.5, 11.9.6, 11.9.7, 11.9.8, 11.9.9,
11.9.10, 11.9.12, 11.10.0, 11.10.1, 11.10.2, 11.10.3, 11.10.4, 11.10.6, 11.10.7,
11.10.8, 11.11.0, 11.11.2, 11.11.3, 11.11.4, 11.11.7, 11.11.8, 12.0.0, 12.0.1,
12.0.2, 12.0.6, 12.0.7, 12.0.9, 12.0.10, 12.0.12, 12.1.1, 12.1.2, 12.1.3,
12.1.4, 12.1.5, 12.1.9, 12.1.10, 12.1.12, 12.1.14, 12.2.0, 12.2.1, 12.2.2,
12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.11, 12.3.0, 12.3.1, 12.3.2,
12.3.4, 12.3.7, 12.3.9, 12.4.0, 12.4.1, 12.4.2, 12.4.3, 12.4.5, 12.4.8, 12.5.0,
12.5.1, 12.5.3, 12.5.4, 12.5.5, 12.5.8, 12.5.9, 12.6.0, 12.6.1, 12.6.2, 12.6.4,
12.6.5, 12.6.6, 12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5, 12.7.9,
12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9, 12.8.10,
12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8, 12.9.10,
12.10.0, 12.10.1, 12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8,
12.10.11, 12.10.12, 12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6,
13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0,
13.1.1, 13.1.2, 13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0,
13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1,
13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2,
13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4,
13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6,
13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8,
13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8,
13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0,
13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3,
13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4,
13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12,
13.12.13, 13.12.14, 13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5,
14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1,
14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2,
14.2.3, 14.2.4, 14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4,
14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:9.4.0:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged
user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
19) CROSS-SITE SCRIPTING
EUVDB-ID: #VU58787
Risk: Low
CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39910
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting')
Exploit availability: No
Description
The disclosed vulnerability allows a remote attacker to perform cross-site
scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data
in Swagger UI. A remote authenticated attacker can trick the victim to follow a
specially crafted link and execute arbitrary HTML and script code in user's
browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to
steal potentially sensitive information, change appearance of the web page,
perform phishing and drive-by-download attacks.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 12.6.0, 12.6.1, 12.6.2, 12.6.3, 12.6.4, 12.6.6,
12.6.7, 12.6.8, 12.7.0, 12.7.1, 12.7.2, 12.7.4, 12.7.5, 12.7.6, 12.7.7, 12.7.8,
12.7.9, 12.8.0, 12.8.1, 12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.8,
12.8.9, 12.8.10, 12.9.0, 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7,
12.9.8, 12.9.9, 12.9.10, 12.10.0, 12.10.1, 12.10.2, 12.10.3, 12.10.4, 12.10.5,
12.10.6, 12.10.7, 12.10.8, 12.10.9, 12.10.10, 12.10.11, 12.10.12, 12.10.13,
12.10.14, 13.0.0, 13.0.1, 13.0.2, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7,
13.0.8, 13.0.9, 13.0.10, 13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2,
13.1.3, 13.1.4, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.1.11,
13.2.0, 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9,
13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3, 13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8,
13.3.9, 13.4.0, 13.4.1, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 13.5.0,
13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6, 13.5.7, 13.6.0, 13.6.1, 13.6.2,
13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0, 13.7.1, 13.7.2, 13.7.3, 13.7.4,
13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0, 13.8.1, 13.8.2, 13.8.3, 13.8.4,
13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1, 13.9.2, 13.9.3, 13.9.4, 13.9.5,
13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2, 13.10.3, 13.10.4, 13.10.5, 13.11.0,
13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5, 13.11.6, 13.11.7, 13.12.0, 13.12.1,
13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6, 13.12.7, 13.12.8, 13.12.9,
13.12.10, 13.12.11, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6,
14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.1.0, 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5,
14.1.6, 14.1.7, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.5, 14.2.6, 14.3.0, 14.3.1,
14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0, 14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
GitLab Enterprise Edition: 12.6.0, 12.6.1, 12.6.2, 12.6.4, 12.6.5, 12.6.6,
12.6.7, 12.7.0, 12.7.1, 12.7.2, 12.7.3, 12.7.4, 12.7.5, 12.7.9, 12.8.0, 12.8.1,
12.8.2, 12.8.3, 12.8.4, 12.8.5, 12.8.6, 12.8.7, 12.8.9, 12.8.10, 12.9.0, 12.9.1,
12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.8, 12.9.10, 12.10.0, 12.10.1,
12.10.2, 12.10.4, 12.10.5, 12.10.6, 12.10.7, 12.10.8, 12.10.11, 12.10.12,
12.10.13, 12.10.14, 13.0.0, 13.0.1, 13.0.3, 13.0.4, 13.0.6, 13.0.7, 13.0.8,
13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.1.0, 13.1.1, 13.1.2,
13.1.3, 13.1.5, 13.1.6, 13.1.7, 13.1.8, 13.1.9, 13.1.10, 13.2.0, 13.2.2, 13.2.3,
13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.10, 13.3.0, 13.3.1, 13.3.2, 13.3.3,
13.3.4, 13.3.5, 13.3.6, 13.3.7, 13.3.8, 13.3.9, 13.4.0, 13.4.2, 13.4.3, 13.4.4,
13.4.5, 13.4.6, 13.4.7, 13.5.0, 13.5.1, 13.5.2, 13.5.3, 13.5.4, 13.5.5, 13.5.6,
13.5.7, 13.6.0, 13.6.1, 13.6.2, 13.6.3, 13.6.4, 13.6.5, 13.6.6, 13.6.7, 13.7.0,
13.7.1, 13.7.2, 13.7.3, 13.7.4, 13.7.5, 13.7.6, 13.7.7, 13.7.8, 13.7.9, 13.8.0,
13.8.1, 13.8.2, 13.8.3, 13.8.4, 13.8.5, 13.8.6, 13.8.7, 13.8.8, 13.9.0, 13.9.1,
13.9.2, 13.9.3, 13.9.4, 13.9.5, 13.9.6, 13.9.7, 13.10.0, 13.10.1, 13.10.2,
13.10.3, 13.10.4, 13.10.5, 13.11.0, 13.11.1, 13.11.2, 13.11.3, 13.11.4, 13.11.5,
13.11.6, 13.11.7, 13.12.0, 13.12.1, 13.12.2, 13.12.3, 13.12.4, 13.12.5, 13.12.6,
13.12.7, 13.12.8, 13.12.9, 13.12.10, 13.12.11, 13.12.12, 13.12.13, 13.12.14,
13.12.15, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7,
14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.1.0, 14.1.1, 14.1.2, 14.1.3,
14.1.4, 14.1.5, 14.1.6, 14.1.7, 14.1.8, 14.2.0, 14.2.1, 14.2.2, 14.2.3, 14.2.4,
14.2.5, 14.2.6, 14.2.7, 14.3.0, 14.3.1, 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.4.0,
14.4.1, 14.4.2, 14.4.3, 14.5.0, 14.5.1
CPE2.3
* cpe:2.3:a:gitlab:gitlab:12.6.8:*:*:*:*:*:*:*
* Full software list in CPE2.3 format available after registration.
External links
http://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the
Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
Please enable JavaScript to view the comments powered by Disqus.
###SIDEBAR###
STAY CONNECTED
*
*
*
*
SECURITY SERVICES
* Actionable & Personalized Vulnerability Intelligence
* On-Demand Security Consulting
* Pricing
IT-CONSULTING
* IT Infrastructure Outsourcing Services
* Web Applications Support & Deployment
* On-Demand Consulting
PARTNER LINKS
* SSL/TLS Security Test by ImmuniWeb
* Web Server Security Test by ImmuniWeb
BLOG
* SonicWall urges customers to patch critical SMA 100 vulnerabilities
* Ransomware attack locks Nordic Choice Hotels' guests out of their rooms
* New ransomware strain targets Confluence and GitLab servers
* Malicious NPM packages caught stealing Discord access tokens
* QNAP warns of a cryptominer targeting its NAS devices
* Read all articles →
Contacts | Terms of use | Privacy Policy
© 2021 Cybersecurity Help s.r.o.
This website is using cookies.
We use them to give you the best experience. If you continue using our website,
we'll assume that you are happy to receive all cookies on this website.
ContinueLearn more
x