Main Vulnerability Database Vulnerabilities #VU45758

Improper Authorization in Gitlab Community Edition and GitLab Enterprise Edition - #VU45758

Published: August 18, 2020 / Updated: August 19, 2020

Vulnerability identifier: #VU45758

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to improper authorization checks when handling deploy tokens that allowed read access to public projects with restricted repositories.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

Remediation

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 13.0.14, 13.1.8, 13.2.6
GitLab Enterprise Edition - addressed in versions 13.0.14, 13.1.8, 13.2.6

External References

Related Security Bulletins