CVE-2021-39945: Medium severity gitlab vulnerability
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39945?
CVE-2021-39945 has been classified with a high severity rating due to its potential impact on access control within the GitLab API.
How do I fix CVE-2021-39945?
To remediate CVE-2021-39945, upgrade your GitLab installation to version 14.3.6 or later, 14.4.4 or later, or 14.5.2 or later.
What versions are affected by CVE-2021-39945?
CVE-2021-39945 affects all GitLab CE and EE versions starting from 9.4 up to prior versions of 14.3.6, 14.4.4, and 14.5.2.
What type of vulnerability is CVE-2021-39945?
CVE-2021-39945 is an improper access control vulnerability allowing unauthorized approval of Merge Requests by project authors.
Who is impacted by CVE-2021-39945?
Users of GitLab CE and EE who utilize the API and who have versions within the specified range are impacted by CVE-2021-39945.