Main Vulnerability Database Vulnerabilities #VU28322

Improper access control in GitLab Enterprise Edition and Gitlab Community Edition - #VU28322

Published: May 28, 2020

Vulnerability identifier: #VU28322

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to unspecified issue, related to misconfigured cloud environments.

GitLab Enterprise Edition
Gitlab Community Edition

Install updates from vendor's website.

GitLab Enterprise Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
Gitlab Community Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1