CVE-2021-39870

Published: Oct 5, 2021Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 11.11.0 to 14.1.7
Gitlab Gitlab	From 14.2.0 to 14.2.5
Gitlab Gitlab	From 14.3.0 to 14.3.1
Gitlab Gitlab	From 11.11.0 to 14.1.7
Gitlab Gitlab	From 14.2.0 to 14.2.5
Gitlab Gitlab	From 14.3.0 to 14.3.1