Vulnerability Details : CVE-2021-39891

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.

Published 2021-10-05 14:15:08

Updated 2022-07-12 17:42:04

Source GitLab Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-39891

Probability of exploitation activity in the next 30 days: 0.08%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 33 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2021-39891

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	nvd@nist.gov
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N	0.7	5.2	cve@gitlab.com
Attack Vector: Network Attack Complexity: High Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-39891

CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-39891

https://gitlab.com/gitlab-org/gitlab/-/issues/335137

Not Found
Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39891.json

2021/CVE-2021-39891.json · master · GitLab.org / cves · GitLab
Vendor Advisory

Products affected by CVE-2021-39891

Gitlab » Gitlab » Community Edition
Versions from including (>=) 8.0.0 and before (<) 14.1.7
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 14.3.0 and before (<) 14.3.1
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 8.0.0 and before (<) 14.1.7
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 14.2.0 and before (<) 14.2.5
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 14.2.0 and before (<) 14.2.5
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 14.3.0 and before (<) 14.3.1
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions