CVE-2021-39945
Assigner: GitLab
Published: 2021-12-13T15:47:49
State: PUBLISHED
affected: product: GitLab
vendor: GitLab
versions: status: affected
version: >=14.5, <14.5.2
status: affected
version: >=14.4, <14.4.4
status: affected
version: >=9.4, <14.3.6
credits: value: Thanks @muthu_prakash for reporting this vulnerability through our HackerOne bug bounty program
descriptions: value: Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
problemTypes: descriptions: description: Improper access control in GitLab
type: text