PT-2021-22740 · Gitlab · Gitlab Ce/Ee+1

Published 2021-10-05 · Updated 2024-03-06 · CVE-2021-39894

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.0 and later

Description: A DNS rebinding vulnerability exists in the Fogbugz importer, which may be used by attackers to exploit Server Side Request Forgery attacks. This issue affects all versions of GitLab CE/EE since version 8.0.

Recommendations: For GitLab CE/EE versions 8.0 and later, consider disabling the Fogbugz importer until a patch is available to prevent exploitation of the DNS rebinding vulnerability. Restrict access to the importer to minimize the risk of Server Side Request Forgery attacks.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-GITLAB-2021-39894

CVE-2021-39894

Affected Products

Gitlab

Gitlab Ce/Ee

References · 10

• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39894.json · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39894 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39894 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39894 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-39894 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2021-39894 · Vendor Advisory
• https://t.me/cvenotify/21910 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/214399 · Note
• https://t.me/cibsecurity/29967 · Telegram Post