MSRXVulnerabilities / CVE-2021-39935
CVE-2021-39935
Published 2021-12-13 · Analyzed
CVE-2021-39935
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-02-03, with a fix-by date of 2026-02-24. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
6.8 MEDIUM
CVSS 3.1 · CNA · gitlab.com
CVSS 3.1 · CNA · gitlab.com
36%
chance of exploitation in the next 30 days (EPSS; higher than 98% of CVEs)
chance of exploitation in the next 30 days (EPSS; higher than 98% of CVEs)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
Scores
Affected products
- gitlab gitlab: ≥ 10.5.0, < 14.3.6; ≥ 14.4.0, < 14.4.4; ≥ 14.5.0, < 14.5.2
Weakness: CWE-918
Also known as: BIT-gitlab-2021-39935
4 references (advisories, patches, write-ups)
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.json · Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/346187 · Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/1236965 · Permissions Required, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39935 · US Government Resource
Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.