PT-2021-22745 · Gitlab · Gitlab Ce/Ee+1

Published 2021-10-04 · Updated 2024-03-06 · CVE-2021-39899

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE (affected versions not specified)

Description An attacker with physical access to a user's machine may brute force the user's password via the change password function. Although there is a rate limit in place, the attack can still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses, passing in the compromised session value from these various locations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

BIT-GITLAB-2021-39899

CVE-2021-39899

Affected Products

Gitlab

Gitlab Ce/Ee

References · 10

• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39899.json · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39899 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2021-39899 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39899 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39899 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39899 · Security Note
• https://t.me/cibsecurity/29894 · Telegram Post
• https://t.me/cvenotify/21879 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/339154 · Note