An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-39935US | high7.5OT critical | KEV | ||
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5… | ||||
02
references
External citations — patches, advisories, analysis.
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.jsonADVISORY
- https://gitlab.com/gitlab-org/gitlab/-/issues/346187ADVISORY
- https://hackerone.com/reports/1236965ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2021-39935WEB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39935WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan