CVE-2021-39937

Name

CVE-2021-39937

Description

A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
MISC	https://gitlab.com/gitlab-org/gitlab/-/issues/336802
CONFIRM	https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39937.json

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:gitlab:gitlab:::::community:::*`	gitlab	>= None	< 14.3.6
`cpe:2.3:a:gitlab:gitlab:::::community:::*`	gitlab	>= 14.4.0	< 14.4.4
`cpe:2.3:a:gitlab:gitlab:::::community:::*`	gitlab	>= 14.5.0	< 14.5.2

References

Match rules

Vulnerable and fixed packages