CVE-2021-39872

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-39872
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-39872.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-39872
Aliases
Downstream
Published
2021-10-05T13:15:08.090Z
Modified
2026-03-14T21:48:08.591588Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.

References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e4567ef4362f4ef24a09112564b31dfe9044ea12
Fixed
9cd657e5179e339171d27e4573b8f5711db1d824
Introduced
e4567ef4362f4ef24a09112564b31dfe9044ea12
Fixed
9cd657e5179e339171d27e4573b8f5711db1d824
Introduced
38bbb40bb77dd3e0f0281c4363e2ef298e650c42
Fixed
72c1da0383a35604f4b2d73a7ed8e6a2c4ee64b1
Introduced
38bbb40bb77dd3e0f0281c4363e2ef298e650c42
Fixed
72c1da0383a35604f4b2d73a7ed8e6a2c4ee64b1
Database specific 
{
    "versions": [
        {
            "introduced": "14.1.0"
        },
        {
            "fixed": "14.1.7"
        },
        {
            "introduced": "14.1.0"
        },
        {
            "fixed": "14.1.7"
        },
        {
            "introduced": "14.2.0"
        },
        {
            "fixed": "14.2.5"
        },
        {
            "introduced": "14.2.0"
        },
        {
            "fixed": "14.2.5"
        }
    ]
}

Affected versions

v14.*
v14.1.0-ee
v14.1.1-ee
v14.1.2-ee
v14.1.3-ee
v14.1.4-ee
v14.1.5-ee
v14.1.6-ee
v14.2.0-ee
v14.2.1-ee
v14.2.2-ee
v14.2.3-ee
v14.2.4-ee

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.3.0"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-39872.json"