Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

GitLab can be tricked into contacting internal servers

CVE-2021-39894 · published 5 years ago
Summary

All supported GitLab Community and Enterprise editions let an attacker use the Fogbugz import feature to make the GitLab server send requests to other machines on your network. This could let them gather information or interact with internal services you didn't intend to expose. Update GitLab to the latest release or apply the provided patch to stop the unwanted requests.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gitlab gitlab >= 8.0.0, < 14.1.7
>= 14.2.0, < 14.2.5
14.3.0
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Original advisory text
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published5 Oct 2021
Updated4 Nov 2026
First seen23 Aug 2026
Sources
CVE-2021-39894 · OSV
CVE-2021-39894 · NVD
Track software like this
Free during beta