CVE-2021-39891: Medium severity GitLab GitLab vulnerability
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39891?
CVE-2021-39891 is considered a Medium severity vulnerability due to potential sensitive information disclosure.
How do I fix CVE-2021-39891?
To fix CVE-2021-39891, upgrade to GitLab version 14.1.8, 14.2.6, or 14.3.2 and ensure access tokens are properly cleared.
What versions of GitLab are affected by CVE-2021-39891?
CVE-2021-39891 affects all GitLab CE/EE versions from 8.0.0 up to 14.1.7, as well as specific versions in the 14.2.x and 14.3.x ranges.
What are access tokens in the context of CVE-2021-39891?
Access tokens are credentials used to authenticate user sessions and control access to resources, which if not cleared can lead to data exposure.
Who is impacted by CVE-2021-39891?
Administrators who impersonate users in GitLab are primarily impacted, as their access tokens may remain active post-impersonation.