PT-2020-11908 · Gitlab · Gitlab

Published 2020-03-13 · Updated 2024-03-06 · CVE-2020-10083

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 12.7 through 12.8.1

Description The issue involves insecure permissions under certain conditions, specifically when changes to project authorization within groups were not being applied as expected.

Recommendations For GitLab versions 12.7 through 12.8.1, consider restricting access to group projects until a fix is applied to ensure that project authorization changes are properly enforced. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

BIT-GITLAB-2020-10083

CVE-2020-10083

Affected Products

Gitlab

References · 6

• https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10083 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10083 · Vendor Advisory
• https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-10083 · Vendor Advisory
• https://t.me/cvenotify/1647 · Telegram Post