CVE-2021-39880
Last modified
CVE-2021-39880 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.. EPSS estimates a 1.33% chance of exploitation in the next 30 days.
Description
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | > 11.9.0, < 14.0.9 |
| Gitlab | Gitlab | >= 11.9.0, < 14.0.9 |
| Gitlab | Gitlab | > 14.1.0, < 14.1.4 |
| Gitlab | Gitlab | >= 14.1.0, < 14.1.4 |
| Gitlab | Gitlab | >= 14.2.0, < 14.2.2 |
References
- https://hackerone.com/reports/1181284Permissions Required, Third Party Advisory
- https://hackerone.com/reports/1181284Permissions Required, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-39880?
How severe is CVE-2021-39880?
How do I fix CVE-2021-39880?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-39875In all versions of GitLab CE/EE since version 13.6, it is po…5.3
- CVE-2021-39876In all versions of GitLab CE/EE since version 11.3, the endp…4.3
- CVE-2021-39877A vulnerability was discovered in GitLab starting with versi…5.5
- CVE-2021-39878A stored Reflected Cross-Site Scripting vulnerability in the…5.4
- CVE-2021-39879Missing authentication in all versions of GitLab CE/EE since…3.5
- CVE-2021-3988A Cross-site Scripting (XSS) vulnerability exists in janeczk…6.1
- CVE-2021-39881In all versions of GitLab CE/EE since version 7.7, the appli…3.5
- CVE-2021-39882In all versions of GitLab CE/EE, provided a user ID, anonymo…5.3
- CVE-2021-39883Improper authorization checks in all versions of GitLab EE s…4.3
- CVE-2021-39884In all versions of GitLab EE since version 8.13, an endpoint…4.3
- CVE-2021-39885A Stored XSS in merge request creation page in all versions …5.4
- CVE-2021-39886Permissions rules were not applied while issues were moved b…4.3
Are you affected by CVE-2021-39880?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST