CVE-2021-39905: 
GitLab vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2021-39905) was discovered in the GitLab CE/EE API since version 8.9.6. The vulnerability allows users to view basic information about private groups that have been shared with public projects. This vulnerability was reported through GitLab's HackerOne bug bounty program and was patched in versions 14.4.1, 14.3.4, and 14.2.6 (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability exists in the Projects API where unauthorized users could access information about private groups through the sharedwithgroups data field when accessing public project information (NVD).

When exploited, this vulnerability allows unauthorized users to view sensitive information about private groups, specifically their name, ID, and full path, when these groups have been shared with public projects. This information disclosure could potentially be used for reconnaissance or to gather intelligence about private group structures within GitLab installations (GitLab Release).

Users are strongly recommended to upgrade to one of the following fixed versions: GitLab 14.4.1, 14.3.4, or 14.2.6. These versions contain the necessary security fixes to address this vulnerability (GitLab Release).