CVE-2021-39944: High severity gitlab vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39944?
CVE-2021-39944 has been classified as a medium severity vulnerability.
How do I fix CVE-2021-39944?
To fix CVE-2021-39944, upgrade GitLab to version 14.3.6 or later, 14.4.4 or later, or 14.5.2 or later.
Who is affected by CVE-2021-39944?
CVE-2021-39944 affects all versions of GitLab CE and EE from 11.0 before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2.
What is the nature of the vulnerability CVE-2021-39944?
CVE-2021-39944 is a permissions validation flaw that allows unauthorized privilege escalation for group members with a developer role.
What should I do if I cannot upgrade to a secure version for CVE-2021-39944?
If unable to upgrade, consider restricting developer role permissions until a secure version can be deployed to mitigate CVE-2021-39944.