CVE-2021-39895: Medium severity GitLab GitLab vulnerability
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39895?
CVE-2021-39895 has been classified as a medium severity vulnerability.
How can I mitigate CVE-2021-39895?
To mitigate CVE-2021-39895, update to GitLab version 14.2.5 or later.
What specific versions of GitLab are affected by CVE-2021-39895?
CVE-2021-39895 affects all versions of GitLab CE/EE since version 8.0 up to 14.1.7 and certain versions in the 14.2.x and 14.3.x series.
What risks are associated with CVE-2021-39895?
The risks associated with CVE-2021-39895 include the potential for information disclosure when pipeline schedules are inadvertently activated during a project import.
Is CVE-2021-39895 a remote or local vulnerability?
CVE-2021-39895 is considered a local vulnerability as it involves actions taken within the platform itself during project imports.