CVE-2021-39871: 
GitLab vulnerability analysis and mitigation

In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call. The vulnerability was discovered internally by a GitLab team member and was assigned CVE-2021-39871. The issue was disclosed on September 30, 2021, and affected both GitLab Community Edition (CE) and Enterprise Edition (EE) (GitLab Release, NVD).

The vulnerability allows attackers to bypass the administrative setting that disables Bitbucket Server import functionality. When an administrator disables Bitbucket Server import source in the admin page under Visibility and access controls, users can still import projects by making crafted API calls to the '/api/v4/import/bitbucket_server' endpoint. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows unauthorized project creation through Bitbucket Server import despite explicit administrative controls prohibiting such actions. This bypass undermines the organization's security controls and project creation policies (GitLab Issue).

The vulnerability was addressed in GitLab versions 14.3.1, 14.2.5, and 14.1.7. Organizations are strongly recommended to upgrade to one of these versions or later to prevent exploitation (GitLab Release).