PT-2020-11902 · Gitlab · Gitlab Ce/Ee+1

Published 2020-03-13 · Updated 2024-03-06 · CVE-2020-10077

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab EE versions 3.0 through 12.8.1

Description The issue allows for Server Side Request Forgery (SSRF), which was discovered through an internal investigation. This investigation found that a particular deprecated service was creating the SSRF risk.

Recommendations For versions 3.0 through 12.8.1, update to a version that fixes the SSRF issue in the deprecated service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-GITLAB-2020-10077

CVE-2020-10077

Affected Products

Gitlab

Gitlab Ce/Ee

References · 5

• https://osv.dev/vulnerability/CVE-2020-10077 · Vendor Advisory
• https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released · Vendor Advisory
• https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-10077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10077 · Security Note