Main Vulnerability Database Vulnerabilities #VU57929

Input validation error in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2021-39908

Published: November 4, 2021

Vulnerability identifier: #VU57929

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39908

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote authenticated attacker can abuse certain Unicode characters to commit malicious code into projects without being noticed in merge request or source code viewer UI.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2021-39908

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 14.2.6, 14.3.4, 14.4.1
GitLab Enterprise Edition - addressed in versions 14.2.6, 14.3.4, 14.4.1

External References

https://about.gitlab.com/releases/2021/10/28/security-release-gitlab-14-4-1-released/

Related Security Bulletins