CVE-2021-39892: Medium severity gitlab vulnerability
Published Jan 18, 2022
·Updated
In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclose email addresses of those users.
Affected Software
6 affected components
GitLab GitLab>=12.0<14.1.7
GitLab GitLab>=12.0<14.1.7
GitLab GitLab>=14.2<14.2.5
GitLab GitLab>=14.2<14.2.5
GitLab GitLab=14.3.0
GitLab GitLab=14.3.0
Event History
Jan 18, 2022
CVE Published
via MITRE·04:52 PM
Data Sourced
via MITRE·04:52 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-39892?
CVE-2021-39892 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2021-39892?
To fix CVE-2021-39892, update your GitLab installation to version 14.3.1 or later.
3
Who is affected by CVE-2021-39892?
All versions of GitLab CE and EE from version 12.0 to 14.2.5 are affected by CVE-2021-39892.
4
What type of vulnerability is CVE-2021-39892?
CVE-2021-39892 is a privilege escalation vulnerability that allows lower privileged users to import other users.
5
What is the impact of CVE-2021-39892?
CVE-2021-39892 allows unauthorized users to disclose the email addresses of users from projects where they lack a maintainer role.