Vulnerability identifier: #VU34098

Vulnerability risk: Medium

CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C]

CVE-ID: CVE-2020-10977

CWE-ID: CWE-22

Exploitation vector: Network

Exploits in database: 8

• May 3, 2021
  • gitlab-cve-2020-10977 (GitLab Arbitrary File Read Exploit) [Github]
• April 1, 2021
  • CVE-2020-10977 (Exploit for "GitLab Instance" Arbitrary server file read vulnerability) [Github]
• March 7, 2021
  • CVE-2020-10977 (Gitlab v12.4.0-8.1 RCE) [Github]
• January 31, 2021
  • gitlab-12.9.0-file-read (A (wanted to be) better script than what can be found on exploit-db about the authenticated arbitrary read file on GitLab v12.9.0 (CVE-2020-10977)) [Github]
• January 24, 2021
  • cve-2020-10977 (GitLab 12.9 Arbitrary File Read) [Github]
• December 9, 2020
  • GitLab File Read Remote Code Execution [Metasploit]
• November 26, 2020
  • CVE-2020-10977.py (authenticated arbitrary file read for Gitlab (CVE-2020-10977)) [Github]
• November 21, 2020
  • cve-2020-10977 (GitLab 12.9.0 Arbitrary File Read ) [Github]

Impact: Information disclosure

Vulnerable software:
GitLab Enterprise Edition
Universal components / Libraries / Software for developers
Gitlab Community Edition
Universal components / Libraries / Software for developers

Vendor: GitLab, Inc