CVE-2021-39945
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4,...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked
Paquets affectés
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"9.4.0"},{"fixed":"14.3.6"},{"introduced":"14.4.0"},{"fixed":"14.4.4"},{"introduced":"14.5.0"},{"fixed":"14.5.2"}]}]
Références
- advisory gitlab.com
- advisory hackerone.com
- web gitlab.com
- web nvd.nist.gov