Vulnerability Description
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.
CVSS Score
2.6
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 10.6.0, < 14.1.7 |
Related Weaknesses (CWE)
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39886.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/330520Broken Link
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39886.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/330520Broken Link
FAQ
What is CVE-2021-39886?
CVE-2021-39886 is a vulnerability with a CVSS score of 2.6 (LOW). Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references...
How severe is CVE-2021-39886?
CVE-2021-39886 has been rated LOW with a CVSS base score of 2.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-39886?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.