IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.8Media KEV

CVE-2021-39935GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

GitLab GitLab Publicada: (hace 4 años)

Explotación conocida — GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

CISA confirmó el 03.02.2026 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 24.02.2026.

Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2021-39935

Descripción

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API

Debilidad (CWE): CWE-918

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
GitLab GitLab >=10.5, <14.3.6, >=14.4, <14.4.4, >=14.5, <14.5.2

Referencias y parches

Coincidencias CPE (NVD) (6)
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* ≥ 10.5.0 < 14.3.6
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* ≥ 10.5.0 < 14.3.6
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* ≥ 14.4.0 < 14.4.4
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* ≥ 14.4.0 < 14.4.4
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* ≥ 14.5.0 < 14.5.2
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* ≥ 14.5.0 < 14.5.2

CVE recientes del mismo producto — GitLab

10.0Crítica
CVE-2026-110264

Integer Overflow or Wraparound in GitLab

GitLab GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could hav…

1.3%EPSS
6.8Media
CVE-2026-12664

Incorrect Authorization in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a proje…

4.3Media
CVE-2026-13319

Authorization Bypass Through User-Controlled Key in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project p…

3.1Baja
CVE-2026-14288

Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a pr…

5.9Media
CVE-2026-16255

Incorrect Authorization in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted …