PT-2020-12653 · Gitlab · Gitlab

Manassehzhou · Published 2020-04-22 · Updated 2024-03-06 · CVE-2020-11506

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 10.7.0 through 12.9.2

Description An issue in GitLab allows a Workhorse bypass, which could lead to job artifact uploads and file disclosure, resulting in the exposure of sensitive information via request smuggling.

Recommendations For GitLab versions 10.7.0 through 12.9.2, update to a version that contains a fix for this issue to prevent Workhorse bypass and potential file disclosure.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BIT-GITLAB-2020-11506

CVE-2020-11506

Affected Products

Gitlab

References · 5

• https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released · Vendor Advisory
• https://about.gitlab.com/blog/categories/releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11506 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11506 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-11506 · Vendor Advisory