Main Vulnerability Database Vulnerabilities #VU57045

Security features bypass in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2021-39874

Published: October 5, 2021

Vulnerability identifier: #VU57045

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39874

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated attacker to compromise the target system.

The vulnerability exists due to the requirement to enforce 2FA is not honored when using git commands.

GitLab Enterprise Edition
Gitlab Community Edition

Install updates from vendor's website.

GitLab Enterprise Edition - addressed in versions 14.1.7, 14.2.5, 14.3.1
Gitlab Community Edition - addressed in versions 14.1.7, 14.2.5, 14.3.1