PT-2020-3619 · Gitlab · Gitlab Ce/Ee+1

Manassehzhou · Published 2020-03-27 · Updated 2024-03-06 · CVE-2020-10955

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE/CE versions 11.1 through 12.9

Description The issue is related to parameter tampering on an upload feature, allowing unauthorized users to read content available under specific folders. This can lead to information disclosure, potentially enabling a remote attacker to access confidential data.

Recommendations For GitLab EE/CE versions 11.1 through 12.9, consider restricting access to the upload feature to minimize the risk of exploitation. As a temporary workaround, limit the ability for unauthorized users to read content from specific folders until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

BDU:2020-03963

BIT-GITLAB-2020-10955

CVE-2020-10955

DSA-4691-1

Affected Products

Gitlab

Gitlab Ce/Ee

References · 10

• https://debian.org/security/2020/dsa-4691 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10955 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4691-1 · Vendor Advisory
• https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-10955 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10955 · Vendor Advisory
• https://about.gitlab.com/releases/categories/releases · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03963 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10955 · Security Note
• https://t.me/cvenotify/2246 · Telegram Post