CVE-2021-39927

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-18 · updated 2026-06-17
Weakness: CWE-918

Description

Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443

Affected products

GitLab: from 8.4 through 14.4.5; from 14.5.0 through 14.5.3; from 14.6.0 through 14.6.3

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39927.json
https://gitlab.com/gitlab-org/gitlab/-/issues/340476
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39927.json
https://gitlab.com/gitlab-org/gitlab/-/issues/340476

Get alerted when CVE-2021-39927 or the next vulnerability affects your stack