CVE-2021-39913

MediumCVSS 4.4

Published: 05/11/2021(UTC)Updated: 12/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.06%

19th percentile - higher than 19% of all known CVEs

Summary

All versions of GitLab CE/EE before 14.2.6, versions from 14.3 to 14.3.4, and versions from 14.4 to 14.4.1 accidentally log the system root password in migration logs. This allows an attacker with local file system access to obtain root-level privileges.

Risk Assessment

The organization is at risk of unauthorized access to the system, which could lead to serious security breaches and data loss.

Recommendation

It is recommended to upgrade GitLab to version 14.2.6 or later, and to monitor migration logs for potential abuse.

Original NVD description (English source)

Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local file system access to obtain system root-level privileges