CVE-2021-39892

Published: Jan 18, 2022Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclose email addresses of those users.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 12.0 to 14.1.7
Gitlab Gitlab	From 14.2 to 14.2.5
Gitlab Gitlab	From 12.0 to 14.1.7
Gitlab Gitlab	From 14.2 to 14.2.5
Gitlab Gitlab	Version 14.3.0
Gitlab Gitlab	Version 14.3.0