« Volver al listado

CVE-2021-39882

Estado: ModificadaMedia (5.3)—

En todas las versiones de GitLab CE/EE, siempre que se disponga de un ID de usuario, unos usuarios anónimos pueden usar algunos endpoints para recuperar información sobre cualquier usuario de GitLab

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gitlab — Gitlab

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-39882",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@gitlab.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@gitlab.com",
      "affectedData": [
        {
          "vendor": "GitLab",
          "product": "GitLab",
          "versions": [
            {
              "status": "affected",
              "version": ">=1.0, <14.1.7"
            },
            {
              "status": "affected",
              "version": ">=14.2, <14.2.5"
            },
            {
              "status": "affected",
              "version": ">=14.3, <14.3.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-05T13:15:08.257",
  "references": [
    {
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39882.json",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@gitlab.com"
    },
    {
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/297473",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@gitlab.com"
    },
    {
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39882.json",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/297473",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user."
    },
    {
      "lang": "es",
      "value": "En todas las versiones de GitLab CE/EE, siempre que se disponga de un ID de usuario, unos usuarios anónimos pueden usar algunos endpoints para recuperar información sobre cualquier usuario de GitLab"
    }
  ],
  "lastModified": "2026-06-17T04:04:21.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15511E8F-E088-49D8-BF62-7C0D3A5252BF",
              "versionEndExcluding": "14.1.7",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2FC870F-C488-49EF-92B2-A46CE6116A94",
              "versionEndExcluding": "14.1.7",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3352A07-9A5A-4CA9-B6F6-71BA3A1D4F9C",
              "versionEndExcluding": "14.2.5",
              "versionStartIncluding": "14.2"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAAC78F3-28E1-4A0D-BA8A-78AE9393B988",
              "versionEndExcluding": "14.2.5",
              "versionStartIncluding": "14.2"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:4.3.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43C7D46F-A414-4818-B74C-547684E7B01D"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:4.3.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35B8762D-58EF-4F52-9C12-6CA842F2E195"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@gitlab.com"
}