CVE-2021-39927: 
GitLab vulnerability analysis and mitigation

Server side request forgery (SSRF) vulnerability in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443. The vulnerability was discovered internally by the GitLab team and was assigned CVE-2021-39927. The issue was disclosed on January 11, 2022 (GitLab Release).

The vulnerability is classified as Server-Side Request Forgery (SSRF) with CWE-918. It received a CVSS v3.1 Base Score of 4.3 (MEDIUM) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, while GitLab assessed it as LOW severity with a CVSS score of 3.5 and vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (NVD).

The vulnerability could allow attackers to send requests to localhost on ports 80 or 443 when GitLab was configured to run on a different port, potentially leading to unauthorized access to internal services (GitLab Release).

The vulnerability was fixed in GitLab versions 14.6.2, 14.5.3, and 14.4.5. Users are strongly recommended to upgrade to these versions or later to mitigate the vulnerability (GitLab Release).