Multiple vulnerabilities in Gitlab



Published: 2020-12-15 | Updated: 2022-06-30
Risk Medium
Patch available YES
Number of vulnerabilities 10
CVE-ID CVE-2020-26407
CVE-2020-26408
CVE-2020-13357
CVE-2020-26411
CVE-2020-26409
CVE-2020-26413
CVE-2020-26417
CVE-2020-26416
CVE-2020-26415
CVE-2020-26412
CWE-ID CWE-79
CWE-200
CWE-284
CWE-399
CWE-400
Exploitation vector Network
Public exploit Public exploit code for vulnerability #6 is available.
Vulnerable software
Subscribe
Gitlab Community Edition
Universal components / Libraries / Software for developers

GitLab Enterprise Edition
Universal components / Libraries / Software for developers

Vendor GitLab, Inc

Security Bulletin

This security bulletin contains information about 10 vulnerabilities.

1) Cross-site scripting

EUVDB-ID: #VU48937

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26407

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via importing a malicious project in Zoom Meeting URL. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 12.4.0 - 13.6.1

GitLab Enterprise Edition: 12.4.0 - 13.6.1

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26407.json
http://gitlab.com/gitlab-org/gitlab/-/issues/212630
http://hackerone.com/reports/832117


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU48938

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26408

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in private profile. A remote user can  view limited information in user's private profile.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GitLab Enterprise Edition: 12.2.0 - 13.6.1

Gitlab Community Edition: before 13.6.2

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26408.json
http://gitlab.com/gitlab-org/gitlab/-/issues/33563
http://hackerone.com/reports/703894


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU48968

Risk: Low

CVSSv3.1: 3.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-13357

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions to feature flag user list. A remote user can get access the user list corresponding to a feature flag in a project.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 13.1.0 - 13.5.4

GitLab Enterprise Edition: 13.1.0 - 13.5.4

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13357.json
http://gitlab.com/gitlab-org/gitlab/-/issues/241132
http://hackerone.com/reports/962408


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource management error

EUVDB-ID: #VU48969

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26411

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. A remote user can use a specific query name for a project search that causes statement timeouts leads to a denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 0.1.5 - 13.6.1

GitLab Enterprise Edition: 6.2.0 - 13.6.1

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26411.json
http://gitlab.com/gitlab-org/gitlab/-/issues/260330


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource exhaustion

EUVDB-ID: #VU48970

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26409

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when performing fields validation. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 10.3 - 13.6.1

GitLab Enterprise Edition: 10.3.0 - 13.6.1

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26409.json
http://gitlab.com/gitlab-org/gitlab/-/issues/259626
http://hackerone.com/reports/990461


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Information disclosure

EUVDB-ID: #VU48971

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26413

CWE-ID: CWE-200 - Information exposure

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to information disclosure via GraphQL starting. A remote attacker can access user emails.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 13.4.0 - 13.6.1

GitLab Enterprise Edition: 13.4.0 - 13.6.1

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26413.json
http://gitlab.com/gitlab-org/gitlab/-/issues/244275
http://hackerone.com/reports/972355


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information disclosure

EUVDB-ID: #VU48972

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26417

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output via GraphQL. A remote attacker can retrieve private group and project membership.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 13.1.0 - 13.6.1

GitLab Enterprise Edition: 13.1.0 - 13.6.1

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26417.json
http://gitlab.com/gitlab-org/gitlab/-/issues/282539


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Information disclosure

EUVDB-ID: #VU48973

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26416

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Advanced Search component of GitLab EE via the search terms of Rails logs. A remote privileged user obtain sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GitLab Enterprise Edition: 8.7.0 - 13.6.1

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26416.json
http://gitlab.com/gitlab-org/gitlab/-/issues/244495


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU48974

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26415

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive information about the starred projects for private user profiles. A remote user can gain unauthorized access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 12.2.0 - 13.6.1

GitLab Enterprise Edition: 12.2.0 - 13.6.1

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26415.json
http://gitlab.com/gitlab-org/gitlab/-/issues/277337


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper access control

EUVDB-ID: #VU48975

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26412

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GitLab Enterprise Edition: 13.2.0 - 13.6.1

External links

http://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26412.json
http://gitlab.com/gitlab-org/gitlab/-/issues/228670


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###