CVE-2021-39890: 
GitLab vulnerability analysis and mitigation

A critical security vulnerability (CVE-2021-39890) was identified in GitLab versions 14.1.1 and above, allowing attackers to bypass Two-Factor Authentication (2FA) for LDAP users and access specific pages using Basic Authentication. The vulnerability was disclosed on December 6, 2021, affecting multiple GitLab versions including GitLab 14.1.1 through 14.1.7, 14.2 through 14.2.5, and 14.3 through 14.3.1 (Ubuntu CVE, MITRE CVE).

The vulnerability received a CVSS v3.1 base score of 9.8 (Critical), indicating its severe nature. The attack vector is network-based, requires low attack complexity, needs no privileges or user interaction, and has an unchanged scope. The vulnerability can potentially result in high impact on confidentiality, integrity, and availability. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Ubuntu CVE).

The vulnerability could allow unauthorized access to protected GitLab resources by bypassing 2FA security measures specifically for LDAP users. This could potentially lead to unauthorized access to sensitive information, modification of data, and system compromise, as indicated by the high impact ratings for confidentiality, integrity, and availability (Ubuntu CVE).

The vulnerability has been fixed in GitLab versions 14.3.1, 14.2.5, and 14.1.7. Users are advised to upgrade to these or later versions to mitigate the security risk (Debian Security).