MEDIUM

CVE-2021-39909

Gitlab GitLab 2021-11-05 CVSS v3.1

CVSS

5.3

Description

Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances

Summary dbcve.org

GitLab EE CODEOWNERS feature lacks email address ownership verification, allowing an attacker to potentially bypass merge request approval requirements under certain rare circumstances by exploiting the verification gap.

Mitigation

Upgrade GitLab EE to version 14.2.6, 14.3.4, or 14.4.1 or later to receive the patch for email ownership verification in the CODEOWNERS feature.

Weakness (CWE)

CWE-347 Improper Signature Verification

EPSS Score

0.61%

Probability of exploitation in next 30 days

48th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39909.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/335191 Broken Link https://hackerone.com/reports/1237750 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE