CVE-2021-39881: Low severity GitLab GitLab vulnerability
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-39881?
CVE-2021-39881 is a vulnerability in GitLab CE/EE that allows a malicious user to create an OAuth client application with arbitrary scope names, potentially tricking unsuspecting users.
Which versions of GitLab CE/EE are affected by CVE-2021-39881?
All versions of GitLab CE/EE since version 7.7 up to version 14.3.1 are affected by CVE-2021-39881.
What is the severity of CVE-2021-39881?
CVE-2021-39881 has a severity rating of 3.5, which is considered low.
How can a malicious user exploit CVE-2021-39881?
A malicious user can exploit CVE-2021-39881 by creating an OAuth client application with spoofed scope names, tricking unsuspecting users into authorizing the application.
Is there a fix or patch available for CVE-2021-39881?
Yes, GitLab has provided a fix for CVE-2021-39881. It is recommended to update to the latest version of GitLab CE/EE to mitigate the vulnerability.