CVE-2021-39919

—

CVSS 3.1

4.4 medium

EPSS

<1%p22

Published

Dec 13, 2021 (Dec 13, 2021)

Modified

Jun 17, 2026

Description

In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure.

Vendors: gitlab
Products: gitlab
Weakness: CWE-640
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.