CVE-2021-39935
CVE-2021-39935
In short
GitLab's CI Lint API allows unauthorized external users to make server-side requests to internal systems. This could let attackers access private resources or internal services that should not be exposed.
Technical detail
Server-Side Request Forgery (SSRF) vulnerability in GitLab CI Lint API (CWE-918) affecting versions 10.5–14.3.5, 14.4–14.4.3, and 14.5–14.5.1. Unauthenticated attackers can craft malicious CI configuration inputs to trigger unauthorized HTTP requests from the GitLab server to internal or external targets, potentially exposing sensitive data or compromising internal services.
Summary generated and translated by AI from the official description.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
GitLab · GitLabWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →