Improper Authorization in GitLab Enterprise Edition and Gitlab Community Edition - #VU28323
Published: May 28, 2020
Vulnerability identifier: #VU28323
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exits due to an error in the group sign-up registration process. A user with an unverified address within the restricted domain could request access to domain restricted groups.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
Remediation
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
Gitlab Community Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
Gitlab Community Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1