PT-2020-11912 · Gitlab · Gitlab

Published 2020-03-13 · Updated 2024-03-06 · CVE-2020-10087

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 12.8.2

Description The issue allows information disclosure due to badge images not being proxied, resulting in mixed content warnings and the leakage of the user's IP address.

Recommendations For versions prior to 12.8.2, update to version 12.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to badge images to minimize the risk of information disclosure.

Fix

Related Identifiers

BIT-GITLAB-2020-10087

CVE-2020-10087

Affected Products

Gitlab

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-10087 · Security Note
• https://ubuntu.com/security/CVE-2020-10087 · Vendor Advisory
• https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10087 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10087 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2020-10087 · Vendor Advisory
• https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10087 · Vendor Advisory
• https://t.me/cvenotify/1651 · Telegram Post