Main Vulnerability Database Vulnerabilities #VU56268

Improper access control in Gitlab Community Edition and GitLab Enterprise Edition - #VU56268

Published: September 2, 2021

Vulnerability identifier: #VU56268

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote authenticated attacker can add and remove Jira Connect Namespaces via the GitLab.com for Jira Cloud application configuration page.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

Remediation

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 14.0.9, 14.1.4, 14.2.2
GitLab Enterprise Edition - addressed in versions 14.0.9, 14.1.4, 14.2.2

External References

https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/

Related Security Bulletins