PT-2020-13089 · Gitlab · Gitlab

Published 2020-04-29 · Updated 2024-03-06 · CVE-2020-12276

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 9.5.9 through 12.9

Description The issue concerns a stored XSS vulnerability in an admin notification feature. This allows for malicious code to be stored and executed when the notification is viewed by an administrator.

Recommendations For GitLab versions 9.5.9 through 12.9, update to a version that contains a fix for this issue to prevent stored XSS attacks. As a temporary workaround, consider restricting access to the admin notification feature until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-GITLAB-2020-12276

CVE-2020-12276

Affected Products

Gitlab

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-12276 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12276 · Vendor Advisory
• https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12276 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12276 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-12276 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12276 · Security Note
• https://t.me/cvenotify/3411 · Telegram Post