Main Vulnerability Database Vulnerabilities #VU28334

Information disclosure in GitLab Enterprise Edition and Gitlab Community Edition - #VU28334

Published: May 29, 2020

Vulnerability identifier: #VU28334

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due Amazon EKS Credentials are disclosed to other administrators of an instance through HTML source code.

GitLab Enterprise Edition
Gitlab Community Edition

Install updates from vendor's website.

GitLab Enterprise Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
Gitlab Community Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1