MEDIUM

CVE-2021-39915

Gitlab GitLab 2021-12-13 CVSS v3.1

CVSS

5.3

Description

Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects

Summary dbcve.org

Improper access control in GitLab's GraphQL API allows unauthenticated or unauthorized users to enumerate project access token names on arbitrary projects. The GraphQL endpoint fails to properly validate user permissions before returning token name information.

Mitigation

Upgrade GitLab to version 14.3.6, 14.4.4, 14.5.2 or later. If immediate upgrade is not possible, consider restricting GraphQL API access or implementing additional access controls at the network layer.

Weakness (CWE)

CWE-668

EPSS Score

1.13%

Probability of exploitation in next 30 days

65th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39915.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/340803 Broken Link https://hackerone.com/reports/1336059 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE