Main Vulnerability Database Vulnerabilities #VU30488

Server-Side Request Forgery (SSRF) in Gitlab Community Edition - CVE-2018-20497

Published: December 30, 2019 / Updated: July 17, 2020

Vulnerability identifier: #VU30488

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2018-20497

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: GitLab, Inc

Affected software:
Gitlab Community Edition

Detailed vulnerability description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

Install update from vendor's website.