Exploit for #VU34098 Path traversal in GitLab Enterprise Edition and Gitlab Community Edition

Vulnerability identifier: #VU34098

Vulnerability risk: Medium

CVSSv4.0: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2020-10977

CWE-ID: CWE-22

Exploitation vector: Network

Exploits in database: 8

• May 3, 2021
  • gitlab-cve-2020-10977 (GitLab Arbitrary File Read Exploit) [Github]
• April 1, 2021
  • CVE-2020-10977 (Exploit for "GitLab Instance" Arbitrary server file read vulnerability) [Github]
• March 7, 2021
  • CVE-2020-10977 (Gitlab v12.4.0-8.1 RCE) [Github]
• January 31, 2021
  • gitlab-12.9.0-file-read (A (wanted to be) better script than what can be found on exploit-db about the authenticated arbitrary read file on GitLab v12.9.0 (CVE-2020-10977)) [Github]
• January 24, 2021
  • cve-2020-10977 (GitLab 12.9 Arbitrary File Read) [Github]
• December 9, 2020
  • GitLab File Read Remote Code Execution [Metasploit]
• November 26, 2020
  • CVE-2020-10977.py (authenticated arbitrary file read for Gitlab (CVE-2020-10977)) [Github]
• November 21, 2020
  • cve-2020-10977 (GitLab 12.9.0 Arbitrary File Read ) [Github]

Vulnerable software:
GitLab Enterprise Edition
Universal components / Libraries / Software for developers
Gitlab Community Edition
Universal components / Libraries / Software for developers

Vendor: GitLab, Inc