HIGH

CVE-2021-39908

Gitlab GitLab 2022-04-01 CVSS v3.1

CVSS

7.5

Description

In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code viewer UI.

Summary dbcve.org

A Unicode character injection vulnerability in GitLab's merge request and source code viewer UI allows attackers to commit malicious code that appears innocuous or benign in the web interface, bypassing code review. The UI fails to properly render or display certain Unicode characters, hiding the actual code content from reviewers.

Mitigation

Upgrade GitLab to version 14.2.6, 14.3.4, 14.4.1 or later. Alternatively, perform code review directly from the command line rather than the web UI as a temporary compensating control.

Weakness (CWE)

CWE-94 Code Injection

EPSS Score

1.27%

Probability of exploitation in next 30 days

68.5th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39908.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/337193 Broken Link https://hackerone.com/reports/1280077 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE