A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions     starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting     from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to     the apollo_upload_server middleware. (CVE-2021-39880)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions
    starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting
    from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to
    the apollo_upload_server middleware. (CVE-2021-39880)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions     starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting     from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to     the apollo_upload_server middleware. (CVE-2021-39880)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
224013	Linux Distros Unpatched Vulnerability : CVE-2021-39880	Nessus	Misc.	Local	medium
419752	SCA: security update for apollo_upload_server (GHSA-w6pv-c757-6rgr)	Tenable Cloud Security	SCA Checks	Local	medium
419752	SCA: security update for apollo_upload_server (GHSA-w6pv-c757-6rgr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
197360	GitLab 11.9 < 14.0.9 / 14.1 < 14.1.4 / 14.2 < 14.2.2 (CVE-2021-39880)	Nessus	CGI abuses	Combined	medium

Detections

Analytics

CVE-2021-39880

medium

Tenable Plugins

medium

medium

medium

medium