CVE-2021-39891
 
Severity Score
4.9
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
En todas las versiones de GitLab CE/EE desde la versión 8.0, los tokens de acceso creados como parte de la suplantación de un usuario por parte del administrador no se borran al final de la suplantación, lo que puede conllevar a una divulgación innecesaria de información confidencial
*Credits:
This vulnerability was found internally by a member of the GitLab team.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-08-23 CVE Reserved
- 2021-10-05 CVE Published
- 2023-04-28 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/335137 | Broken Link |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39891.json | 2022-07-12 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 8.0.0 < 14.1.7 Search vendor "Gitlab" for product "Gitlab" and version " >= 8.0.0 < 14.1.7" | community |
Affected
| ||||||
Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 8.0.0 < 14.1.7 Search vendor "Gitlab" for product "Gitlab" and version " >= 8.0.0 < 14.1.7" | enterprise |
Affected
| ||||||
Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 14.2.0 < 14.2.5 Search vendor "Gitlab" for product "Gitlab" and version " >= 14.2.0 < 14.2.5" | community |
Affected
| ||||||
Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 14.2.0 < 14.2.5 Search vendor "Gitlab" for product "Gitlab" and version " >= 14.2.0 < 14.2.5" | enterprise |
Affected
| ||||||
Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 14.3.0 < 14.3.1 Search vendor "Gitlab" for product "Gitlab" and version " >= 14.3.0 < 14.3.1" | community |
Affected
| ||||||
Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 14.3.0 < 14.3.1 Search vendor "Gitlab" for product "Gitlab" and version " >= 14.3.0 < 14.3.1" | enterprise |
Affected
|