CVE-2021-39904
Assigner: GitLab
Published: 2021-11-04T23:13:11
State: PUBLISHED
affected: product: GitLab
vendor: GitLab
versions: status: affected
version: >=13.1, <14.2.6
status: affected
version: >=14.3, <14.3.4
status: affected
version: >=14.4, <14.4.1
credits: value: Thanks jimeno for reporting this vulnerability through our HackerOne bug bounty program
descriptions: value: An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
problemTypes: descriptions: description: Improper access control in GitLab
type: text