PT-2021-22774 · Gitlab · Gitlab Ce/Ee+1

Minhlion · Published 2021-06-17 · Updated 2026-02-11 · CVE-2021-39935

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.5 through 14.3.5 GitLab CE/EE versions 14.4 through 14.4.3 GitLab CE/EE versions 14.5 through 14.5.1

Description An issue has been discovered in GitLab CE/EE where unauthorized external users could perform Server Side Requests via the CI Lint API.

Recommendations For versions 10.5 through 14.3.5, update to version 14.3.6 or later. For versions 14.4 through 14.4.3, update to version 14.4.4 or later. For versions 14.5 through 14.5.1, update to version 14.5.2 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-02875

BIT-GITLAB-2021-39935

CVE-2021-39935

Affected Products

Gitlab

Gitlab Ce/Ee

References · 34

• https://nvd.nist.gov/vuln/detail/CVE-2021-39935 · Security Note
• https://bdu.fstec.ru/vul/2025-02875 · Security Note
• https://ubuntu.com/security/CVE-2021-39935 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-39935 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/346187 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39935 · Vendor Advisory
• https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39935 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39935 · Security Note
• https://twitter.com/RoryCrave/status/2019281032466321596 · Twitter Post
• https://t.me/avleonovcom/1630 · Telegram Post
• https://t.me/cveNotify/150861 · Telegram Post
• https://twitter.com/dailycve/status/2018740188852167098 · Twitter Post
• https://t.me/cveNotify/150735 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1qvuhf2/cisa_alerts_on_longstanding_gitlab_flaw_being · Reddit Post