CVE-2021-39881: 
GitLab vulnerability analysis and mitigation

In all versions of GitLab CE/EE since version 7.7, a vulnerability was discovered that allows malicious users to create OAuth client applications with arbitrary scope names. This vulnerability (CVE-2021-39881) was disclosed on October 5, 2021, affecting both GitLab Community Edition (CE) and Enterprise Edition (EE) installations (NVD, GitLab Release).

The vulnerability has been assigned a CVSS v3.1 Base Score of 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. The issue stems from improper validation of OAuth scope names during the creation of OAuth client applications, which could allow attackers to define custom scope names and descriptions (NVD).

The vulnerability allows malicious users to trick unsuspecting users into authorizing malicious client applications by using spoofed scope names and descriptions. This social engineering vector could lead to users granting permissions to malicious applications under false pretenses (GitLab Release).

The vulnerability has been fixed in GitLab versions 14.3.1, 14.2.5, and 14.1.7. Users are strongly recommended to upgrade to these or later versions to mitigate the risk. The fix includes proper validation of OAuth scope names during application creation (GitLab Release).