CVE-2021-39879

LOW

GitLab 7.11.0-14.1.7 - Missing Authentication for Two-Factor Disabling

Title source: llm
STIX 2.1

Description

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication

References (2)

Core 2
Core References

Scores

CVSS v3 2.2
EPSS 0.0012
EPSS Percentile 31.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-306
Status published
Products (1)
gitlab/gitlab 7.11.0 - 14.1.7 (2 CPE variants)
Published Oct 04, 2021
Tracked Since Feb 18, 2026