Main Vulnerability Database Vulnerabilities #VU28327

Information disclosure in Gitlab Community Edition and GitLab Enterprise Edition - #VU28327

Published: May 28, 2020

Vulnerability identifier: #VU28327

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Kubernetes cluster token is visible to other group maintainers.

Gitlab Community Edition
GitLab Enterprise Edition

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
GitLab Enterprise Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1