CVE-2021-39903

Published: Nov 4, 2021Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 13.0.0 to 14.2.6
Gitlab Gitlab	From 14.3.0 to 14.3.4
Gitlab Gitlab	From 13.0.0 to 14.2.6
Gitlab Gitlab	From 14.3.0 to 14.3.4
Gitlab Gitlab	Version 14.4.0
Gitlab Gitlab	Version 14.4.0