CVE-2021-39872: Medium severity GitLab GitLab vulnerability
In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39872?
CVE-2021-39872 is classified as a high severity vulnerability due to improper access control allowing expired users to access GitLab via access tokens.
How do I fix CVE-2021-39872?
To mitigate CVE-2021-39872, users should upgrade to GitLab versions 14.1.8, 14.2.6, or later where this vulnerability is patched.
What versions of GitLab are affected by CVE-2021-39872?
CVE-2021-39872 affects all versions of GitLab CE/EE starting from 14.1.0 up to and including 14.1.7 and 14.2.0 up to and including 14.2.5.
Who is impacted by CVE-2021-39872?
Users with expired passwords are impacted by CVE-2021-39872, as they can still access GitLab through git and API using previously acquired access tokens.
Are there any workarounds for CVE-2021-39872?
Currently, the recommended solution for CVE-2021-39872 is to upgrade to a patched version of GitLab, as there are no effective workarounds available.