Input validation error in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2021-39895
Published: November 4, 2021
Vulnerability identifier: #VU57930
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-39895
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to pipeline schedules on imported projects can be set to automatically active after import. A remote administrator can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2021-39895
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 14.2.6, 14.3.4, 14.4.1
Gitlab Community Edition - addressed in versions 14.2.6, 14.3.4, 14.4.1
Gitlab Community Edition - addressed in versions 14.2.6, 14.3.4, 14.4.1