CVE-2021-39937

MEDIUM

GitLab < 14.3.6, 14.4-14.4.4, 14.5-14.5.2 - Improper Privilege Management via Access Memoization Collision

Title source: llm
STIX 2.1

Description

A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances

References (2)

Core 2

Scores

CVSS v3 5.9
EPSS 0.0075
EPSS Percentile 50.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Details

CWE
CWE-269
Status published
Products (1)
gitlab/gitlab < 14.3.6 (2 CPE variants)
Published Dec 13, 2021
Tracked Since Feb 18, 2026