CVE-2021-39872
In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab...
Original description
The description as published by the source.
In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"14.1.0"},{"fixed":"14.1.7"},{"introduced":"14.2.0"},{"fixed":"14.2.5"},{"introduced":"14.3.0"},{"fixed":"14.3.1"}]}]
References
- advisory gitlab.com
- report gitlab.com
- report hackerone.com
- web nvd.nist.gov