VulnerabilityModified
CVE-2021-39886
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.
MEDIUM 4.3EPSS 0.56%
Does this matter?
Lower severity and a low EPSS score (0.56%). Track it; it rarely justifies an emergency change on its own.
Description
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.56% probability · 45th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-276
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39886.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/330520Broken Link
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39886.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/330520Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.