PT-2020-11904 · Gitlab · Gitlab

Published 2020-03-13 · Updated 2024-03-06 · CVE-2020-10079

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 7.10 through 12.8.1

Description The issue is related to Incorrect Access Control, where under certain conditions, users were not required to configure two-factor authentication when they should have been.

Recommendations For GitLab versions 7.10 through 12.8.1, update to a version that requires two-factor authentication under the correct conditions to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-GITLAB-2020-10079

CVE-2020-10079

Affected Products

Gitlab

References · 9

• https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10079 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10079 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10079 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10079 · Vendor Advisory
• https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-10079 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10079 · Vendor Advisory
• https://t.me/cvenotify/1643 · Telegram Post