Information disclosure in Gitlab Community Edition and GitLab Enterprise Edition - #VU28328
Published: May 28, 2020
Vulnerability identifier: #VU28328
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to application may expose presence of files on the system. A remote non-authenticated attacker can send a specially crafted request and confirm the existence of files hosted on object storage services, without disclosing their contents.
Affected software
Gitlab Community Edition
GitLab Enterprise Edition
GitLab Enterprise Edition
Remediation
Install updates from vendor's website.
Gitlab Community Edition - addressed in versions 12.10.7, 13.0.1
GitLab Enterprise Edition - addressed in versions 12.10.7, 13.0.1
GitLab Enterprise Edition - addressed in versions 12.10.7, 13.0.1