Improper Authorization in GitLab Enterprise Edition and Gitlab Community Edition - #VU28329
Published: May 29, 2020
Vulnerability identifier: #VU28329
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to update data of other users.
The vulnerability exists due to insecure authorization check that allows a remote authenticated user to update permissions of other users' deploy keys under certain conditions.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
Remediation
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
Gitlab Community Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
Gitlab Community Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1