CVE-2021-39898: Infoleak
Published Nov 4, 2021
·Updated
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
Affected Software
6 affected components
GitLab GitLab>=10.6.0<14.1.7
GitLab GitLab>=10.6.0<14.1.7
GitLab GitLab>=14.2.0<14.2.5
GitLab GitLab>=14.2.0<14.2.5
GitLab GitLab=14.3.0
GitLab GitLab=14.3.0
Event History
Nov 4, 2021
CVE Published
via MITRE·11:21 PM
Data Sourced
via MITRE·11:21 PM
DescriptionSeverityWeakness
Nov 5, 2021
Data Sourced
via OSV·12:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2021-39898?
CVE-2021-39898 has a severity rating of medium, indicating a potential security risk due to the exposure of webhook tokens.
2
How do I fix CVE-2021-39898?
To remediate CVE-2021-39898, users should upgrade to GitLab versions 14.1.7, 14.2.5, or later.
3
What types of GitLab installations are affected by CVE-2021-39898?
CVE-2021-39898 affects all versions of GitLab CE/EE from 10.6 up to 14.1.7 and from 14.2.0 up to 14.2.5.
4
What is the impact of CVE-2021-39898?
The impact of CVE-2021-39898 is the potential leakage of external webhook tokens, which could allow unauthorized access to the exported project.
5
When was CVE-2021-39898 discovered?
CVE-2021-39898 was reported and made public in 2021.