What is CVE-2021-39908?

CVE-2021-39908 is a medium-severity vulnerability in Gitlab, classified under Code Injection. CVSS score: 6.5/10. Published 2022-04-01.

How severe is CVE-2021-39908?

Medium severity. CVSS v3 base score is 6.5 out of 10.

RCE in Gitlab

CVE-2021-39908

In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code viewer UI.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.012 (65.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Gitlab — versions >=0.8.0, <14.2.6, 14.4.0, >=14.3, <14.3.4

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@gitlab.com (x_refsource_MISC, Broken Link)
cve@gitlab.com (Permissions Required, Third Party Advisory, x_refsource_MISC)
cve@gitlab.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2021-39908?: CVE-2021-39908 is a medium-severity vulnerability in Gitlab, classified under Code Injection. CVSS score: 6.5/10. Published 2022-04-01.
How severe is CVE-2021-39908?: Medium severity. CVSS v3 base score is 6.5 out of 10.