CVE-2021-39872
MEDIUMCVSS 6.5/10EPSS 0.96%
Last modified
CVE-2021-39872 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.. EPSS estimates a 0.96% chance of exploitation in the next 30 days.
Description
In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 14.1.0, < 14.1.7 |
| Gitlab | Gitlab | >= 14.2.0, < 14.2.5 |
| Gitlab | Gitlab | 4.3.0 |
References
- https://hackerone.com/reports/1285226Permissions Required, Third Party Advisory
- https://hackerone.com/reports/1285226Permissions Required, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-39872?
In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.
How severe is CVE-2021-39872?
CVE-2021-39872 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.96% probability of exploitation in the next 30 days.
How do I fix CVE-2021-39872?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-39867In all versions of GitLab CE/EE since version 8.15, a DNS re…8.1
- CVE-2021-39868In all versions of GitLab CE/EE since version 8.12, an authe…4.3
- CVE-2021-39869In all versions of GitLab CE/EE since version 8.9, project e…6.5
- CVE-2021-3987An improper access control vulnerability exists in janeczku/…4.3
- CVE-2021-39870In all versions of GitLab CE/EE since version 11.11, an inst…4.3
- CVE-2021-39871In all versions of GitLab CE/EE since version 13.0, an insta…4.3
- CVE-2021-39873In all versions of GitLab CE/EE, there exists a content spoo…4.3
- CVE-2021-39874In all versions of GitLab CE/EE since version 11.0, the requ…4.3
- CVE-2021-39875In all versions of GitLab CE/EE since version 13.6, it is po…5.3
- CVE-2021-39876In all versions of GitLab CE/EE since version 11.3, the endp…4.3
- CVE-2021-39877A vulnerability was discovered in GitLab starting with versi…5.5
- CVE-2021-39878A stored Reflected Cross-Site Scripting vulnerability in the…5.4
Are you affected by CVE-2021-39872?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST