Lucene search

[email protected]NVD:CVE-2021-39911

HistoryNov 05, 2021 - 12:15 a.m.

CVE-2021-39911

2021-11-0500:15:11

[email protected]

web.nvd.nist.gov

gitlab

access control

email addresses

webhook

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.7%

JSON

An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers

Affected configurations

Nvd

Node

gitlabgitlabRange13.9.0–14.2.6community

gitlabgitlabRange13.9.0–14.2.6enterprise

gitlabgitlabRange14.3.0–14.3.4community

gitlabgitlabRange14.3.0–14.3.4enterprise

gitlabgitlabMatch14.4.0community

gitlabgitlabMatch14.4.0enterprise

VendorProductVersionCPE
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
gitlabgitlab14.4.0cpe:2.3:a:gitlab:gitlab:14.4.0:*:*:*:*:community:*:*
gitlabgitlab14.4.0cpe:2.3:a:gitlab:gitlab:14.4.0:*:*:*:*:enterprise:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::community:::*
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
gitlab	gitlab	14.4.0	cpe:2.3:a:gitlab:gitlab:14.4.0:::::community::
gitlab	gitlab	14.4.0	cpe:2.3:a:gitlab:gitlab:14.4.0:::::enterprise::