Log in Start free

Vulnerability · Published Oct 4, 2021 · Assigned by GitLab

CVE-2021-39899

Low 2.9

In plain English

A low-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)2.9Low
Exploit odds (30 days)0.3%top 82.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from these various locations.

Affected products (as reported)

VendorProductVersions
GitLab GitLab >=1.0, <14.1.7>=14.2, <14.2.5>=14.3, <14.3.1

References