CVE-2021-39872

In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through…

Medium · published October 5, 2021

CVSS v3.1
6.5
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00989 · 62.2th percentile
Published
2021-10-05T12:34Z
EPSS history
Timeline
  • 05 OCT 12:34Z
    In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through…
    cvelistv5