Vulnerability Intelligence Report
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
CVE-2021-39935
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
6.8
MEDIUM
Exploitability:2.3
Impact Score:4.0
EPSS Probability:30.50%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-918 ↗CWE-918 Server-Side Request Forgery (SSRF)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| GitLab | GitLab | >=10.5, <14.3.6 (affected), >=14.4, <14.4.4 (affected), >=14.5, <14.5.2 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitLab Inc. · Vendor · USA |
| Reserved | 2021-08-23T00:00:00 |
| Published | 2021-12-13T15:47:59 |
| Last Updated | 2026-02-03T17:20:23 |
Community Chatter & Buzz