Main Vulnerability Database Vulnerabilities #VU50848

Improper access control in Gitlab Community Edition and GitLab Enterprise Edition - #VU50848

Published: February 22, 2021

Vulnerability identifier: #VU50848

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. Demoted project members can access details on authored merge requests.

Gitlab Community Edition
GitLab Enterprise Edition

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 13.6.7, 13.7.7, 13.8.4
GitLab Enterprise Edition - addressed in versions 13.6.7, 13.7.7, 13.8.4