An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see     basic information on private groups that a public project has been shared with (CVE-2021-39905)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see     basic information on private groups that a public project has been shared with (CVE-2021-39905)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Gitlab reports :

Stored XSS via ipynb files

Pipeline schedules on imported projects can be set to automatically active after import

Potential Denial of service via Workhorse

Improper Access Control allows Merge Request creator to bypass locked status

Projects API discloses ID and name of private groups

Severity of an incident can be changed by a guest user

System root password accidentally written to log file

Potential DoS via a malformed TIFF image

Bypass of CODEOWNERS Merge Request approval requirement

Change project visibility to a restricted option

Project exports leak external webhook token value

SCIM token is visible after creation

Invited group members, with access inherited from parent group, continue to have project access even after invited subgroup is transfered

Regular expression denial of service issue when cleaning namespace path

Prevent creation of scopeless apps using applications API

Webhook data exposes assignee's private email address

ID	Name	Product	Family	Severity
257514	Linux Distros Unpatched Vulnerability : CVE-2021-39905	Nessus	Misc.	medium
187478	GitLab 8.9.6 < 14.2.6 (CVE-2021-39905)	Nessus	CGI abuses	medium
154774	FreeBSD : Gitlab -- Multiple Vulnerabilities (33557582-3958-11ec-90ba-001b217b3468)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-39905

medium

Tenable Plugins

medium

medium

medium