PT-2021-22747 · Gitlab · Gitlab

Published 2021-10-04 · Updated 2024-03-06 · CVE-2021-39900

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 10.8 and later

Description The issue allows for information disclosure from SendEntry in GitLab, exposing the full URL of artifacts stored in object-storage. This exposure occurs via Rails logs and is temporary.

Recommendations For GitLab versions 10.8 and later, update to a version that includes a fix for this issue to prevent information disclosure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BIT-GITLAB-2021-39900

CVE-2021-39900

Affected Products

Gitlab

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-39900 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-39900 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39900 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39900 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-39900 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39900 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39900.json · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/325088 · Note
• https://t.me/cvenotify/21878 · Telegram Post