CVE-2021-39890

It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.

CVSS v3 3.1 LOW
CVSS v2.0 7.5 HIGH

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39890.json	Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/341522	Broken Link Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39890.json	Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/341522	Broken Link Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab::::::::
	cpe:2.3:a:gitlab:gitlab::::::::
	cpe:2.3:a:gitlab:gitlab:14.3.0::::community:::
	cpe:2.3:a:gitlab:gitlab:14.3.0::::enterprise:::
	cpe:2.3:a:gitlab:gitlab:14.3.1::::community:::
	cpe:2.3:a:gitlab:gitlab:14.3.1::::enterprise:::

History

21 Nov 2024, 06:20

Type	Values Removed	Values Added
CVSS	v2 : ~~7.5~~ v3 : ~~9.8~~	v2 : 7.5 v3 : 3.1
References	~~() https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39890.json - Third Party Advisory~~	() https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39890.json - Third Party Advisory
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/341522 - Broken Link, Third Party Advisory~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/341522 - Broken Link, Third Party Advisory

Information

Published : 2021-12-06 18:15

Updated : 2024-11-21 06:20

NVD link : CVE-2021-39890

Mitre link : CVE-2021-39890

CVE.ORG link : CVE-2021-39890

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-287

Improper Authentication

{"id": "CVE-2021-39890", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-12-06T18:15:08.127", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39890.json", "tags": ["Third Party Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/341522", "tags": ["Broken Link", "Third Party Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39890.json", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/341522", "tags": ["Broken Link", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above."}, {"lang": "es", "value": "Era posible omitir el 2FA para usuarios de LDAP y acceder a algunas p\u00e1ginas espec\u00edficas con autenticaci\u00f3n b\u00e1sica en GitLab versiones 14.1.1 y posteriores"}], "lastModified": "2024-11-21T06:20:29.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FE74A88-01A4-4A1E-A9AB-8CCE6144ED44", "versionEndExcluding": "14.1.7", "versionStartIncluding": "14.1.1"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EDBFD35-59F1-4F5A-83D6-5F705C1E6CF9", "versionEndExcluding": "14.2.5", "versionStartIncluding": "14.2.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:14.3.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "3E754C1F-3FB2-4387-8523-19896FDE7A14"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:14.3.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "ED0EDF4C-4350-476E-A6C4-C2FEFC2078D8"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:14.3.1:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "09C2D2FA-0C57-43B6-91E4-538748910E18"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:14.3.1:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "12127E60-FAFA-4D5F-B23D-F9D2B3C33EED"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}