CVE-2021-39890
Description
It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.
Summary dbcve.org
A vulnerability in GitLab allowed LDAP users to bypass two-factor authentication (2FA) and access certain pages using Basic Authentication instead. This authentication bypass occurs because the application improperly validates LDAP-backed user sessions when 2FA is enforced, permitting access to protected resources without completing the second factor requirement.
Mitigation
Upgrade GitLab to the version that addresses this vulnerability (consult GitLab's security release for the specific patch version). For LDAP users, ensure 2FA policies are properly enforced and consider additional access controls while patches are applied.