CVE-2021-39879

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-39886.1A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occur CVE-2021-398806.5A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all ve CVE-2021-398813.5In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrar CVE-2021-398825.3In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.CVE-2021-398834.3Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5,CVE-2021-398844.3In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileg CVE-2021-398855.4A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 b CVE-2021-398864.3Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up t CVE-2021-398875.4A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to exe CVE-2021-398884.3In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting fro CVE-2021-398894.3In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protec CVE-2021-39896.1showdoc is vulnerable to URL Redirection to Untrusted Site