CVE-2021-4191 - An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2

Back Back to CVE browser

MEDIUM

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2

Published Mar 28, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 80.00%

Description

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.

Affected products

Vendor GitLab Product GitLab Default
n/a
- Version
  >=13.0, <14.6.5
  Status
  affected
  Constraints
  -
- Version
  >=14.7, <14.7.4
  Status
  affected
  Constraints
  -
- Version
  >=14.8, <14.8.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

n/a

Version	Status	Constraints
>=13.0, <14.6.5	affected	-
>=14.7, <14.7.4	affected	-
>=14.8, <14.8.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34051
Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4191.json
x_refsource_CONFIRMVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/343898
x_refsource_MISCBroken Link
https://hackerone.com/reports/1089609
x_refsource_MISCPermissions RequiredThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34051		Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4191.json		x_refsource_CONFIRMVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/343898		x_refsource_MISCBroken Link
https://hackerone.com/reports/1089609		x_refsource_MISCPermissions RequiredThird Party Advisory