p PatchFirst

CVE-2021-39884

CVE-2021-39884

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileged users that are part of that project.

CVSS 4.3 · Medium · EPSS 1.1%

Published
Updated

Stack: system

Affected products and versions

  • gitlab

    Versions
    • >=8.13, <14.1.7: Affected
    • >=14.2, <14.2.5: Affected
    • >=14.3, <14.3.1: Affected

    No fix published

  • gitlab Ubuntu:16.04:LTS

    Versions
    • 8.4.3+dfsg-9
    • 8.4.3+dfsg-12
    • 8.5.8+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →