Skip to content
OpenAdvisories
Medium · 5.3 CVE-2021-39882 EUVD-2021-26238GHSA-6463-hw74-9748

In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.

Published Oct 5, 2021 · Updated Aug 4, 2024 · Assigned by GitLab

Vendor: GitLab Product: GitLab Package: gitlab Category: Web / CMS Ecosystem: Ubuntu

Description

In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.

Affected products

VendorProductAffectedFixed
GitLab GitLab >=1.0, <14.1.7, >=14.2, <14.2.5, >=14.3, <14.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS gitlab No fix yet —

References